Windows: Microsoft Exchange Control Panel error with ViewState parameter indicating CVE-2020-0688 exploitation

title: "Windows: Microsoft Exchange Control Panel error with ViewState parameter indicating CVE-2020-0688 exploitation"
id: 03a7f2aa-8bc7-48de-96b5-1f8d6b0f86ac
status: test
description: This rule flags Windows application logs when the Microsoft Exchange Control Panel reports an error (EventID 4, Level Error) and the event includes a ViewState parameter pattern. Attackers exploiting CVE-2020-0688 may generate malformed or malicious requests that lead to error events from Exchange’s control panel. The detection relies on Windows application log telemetry containing the provider name, event ID/level, and a matching ViewState marker in the logged message fields.
references:
  - https://www.trustedsec.com/blog/detecting-cve-20200688-remote-code-execution-vulnerability-on-microsoft-exchange-server/
  - https://cyberpolygon.com/materials/okhota-na-ataki-ms-exchange-chast-2-cve-2020-0688-cve-2020-16875-cve-2021-24085/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-0688/win_vul_cve_2020_0688.yml
author: Florian Roth (Nextron Systems), wagga, Huntrule Team
date: 2020-02-29
modified: 2022-12-25
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2020-0688
  - detection.emerging-threats
logsource:
  product: windows
  service: application
detection:
  selection1:
    EventID: 4
    Provider_Name: MSExchange Control Panel
    Level: Error
  selection2:
    - "&__VIEWSTATE="
  condition: all of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: d6266bf5-935e-4661-b477-78772735a7cb
    type: derived