Windows MSExchange Management: Post-ProxyLogon Set-OabVirtualDirectory with suspicious parameters

title: "Windows MSExchange Management: Post-ProxyLogon Set-OabVirtualDirectory with suspicious parameters"
id: 5ec9cf59-cd4e-4492-a07a-f09c8a3ec71f
status: test
description: This rule matches command execution activity in Microsoft Exchange management telemetry associated with a Commandlet invocation of Set-OabVirtualDirectory using specific external URL and parameter patterns. The matched content includes encoded or embedded script fragments and function-like markers consistent with malicious payload injection following ProxyLogon exploitation. It relies on keyword matching for the OabVirtualDirectory cmdlet string and a set of suspicious parameter patterns within the observed command context.
references:
  - https://bi-zone.medium.com/hunting-down-ms-exchange-attacks-part-1-proxylogon-cve-2021-26855-26858-27065-26857-6e885c5f197c
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/msexchange/win_exchange_proxylogon_oabvirtualdir.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-08-09
modified: 2023-01-23
tags:
  - attack.t1587.001
  - attack.resource-development
logsource:
  product: windows
  service: msexchange-management
detection:
  keywords_cmdlet:
    "|all":
      - OabVirtualDirectory
      - " -ExternalUrl "
  keywords_params:
    - eval(request
    - http://f/<script
    - '"unsafe"};'
    - function Page_Load()
  condition: keywords_cmdlet and keywords_params
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 550d3350-bb8a-4ff3-9533-2ba533f4a1c0
    type: derived