huntrule

Windows MSExchangeMailboxReplication Writes ASP/ASPX Files

Alerts when MSExchangeMailboxReplication.exe writes .asp or .aspx files on Windows, indicating potentially malicious server-side script drops.

FreeUnreviewedSigmahighv1
title: Windows MSExchangeMailboxReplication Writes ASP/ASPX Files
id: 2eb26282-71f4-4ec5-98a0-ba40378955aa
status: test
description: This rule flags file events where MSExchangeMailboxReplication.exe writes files with .asp or .aspx extensions to disk. Attackers can use server-side scripting file drops to establish or alter web-accessible behavior, making this activity high risk. The detection relies on Windows file telemetry capturing the writing process image path and the target filename extension.
references:
  - https://redcanary.com/blog/blackbyte-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_exchange_aspx_write.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-02-25
tags:
  - attack.initial-access
  - attack.t1190
  - attack.persistence
  - attack.t1505.003
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith: \MSExchangeMailboxReplication.exe
    TargetFilename|endswith:
      - .aspx
      - .asp
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7280c9f3-a5af-45d0-916a-bc01cb4151c9
    type: derived

What it detects

This rule flags file events where MSExchangeMailboxReplication.exe writes files with .asp or .aspx extensions to disk. Attackers can use server-side scripting file drops to establish or alter web-accessible behavior, making this activity high risk. The detection relies on Windows file telemetry capturing the writing process image path and the target filename extension.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.