Windows MSExchangeMailboxReplication .aspx/.asp File Writes Indicating Web Shell Upload

Alerts when MSExchangeMailboxReplication.exe writes .asp or .aspx files on Windows, indicating potentially malicious server-side script drops.

FreeReviewedSigma · High · v2

Product: windows
Category: file_event
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-02-25
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access → Persistence

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
- T1505.003Web Shell
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags instances where MSExchangeMailboxReplication.exe writes files ending in .aspx or .asp to disk. Such extensions are commonly associated with server-side script and can indicate an attempt to deploy a web-accessible backdoor. It relies on Windows file event telemetry that records the executing image path and the target filename written to disk.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Malicious Web Shell Written to SharePoint LAYOUTS Directory by Worker Process (via file_event)

Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)

Possible GoAnywhere MFT Exploitation via Tomcat Spawning Discovery Commands

Suspicious Command Shell Spawned by MSSQL Server Process Indicating Webshell

Malicious MOVEit Transfer Exploitation via X-siLock HTTP Headers (via webserver)

Malicious IIS w3wp Worker Spawning Command Interpreter via SharePoint Web Shell

Suspicious Single-Character Named Executable Launched by Web Server Process (via process_creation)

Malicious MOVEit human2.aspx Web Shell Dropped in wwwroot (via file_event)

Malicious IIS Worker Process Spawning PowerShell via Gladinet CentreStack Exploit

Windows MSExchangeMailboxReplication .aspx/.asp File Writes Indicating Web Shell Upload

Pivot detection · T1190 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-msexchangemailboxreplication-writes-asp-aspx-files-7280c9f3

title: Windows MSExchangeMailboxReplication .aspx/.asp File Writes Indicating Web Shell Upload
id: 2eb26282-71f4-4ec5-98a0-ba40378955aa
status: test
description: This rule flags instances where MSExchangeMailboxReplication.exe writes files ending in .aspx or .asp to disk. Such extensions are commonly associated with server-side script and can indicate an attempt to deploy a web-accessible backdoor. It relies on Windows file event telemetry that records the executing image path and the target filename written to disk.
references:
  - https://redcanary.com/blog/blackbyte-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_exchange_aspx_write.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-02-25
tags:
  - attack.initial-access
  - attack.t1190
  - attack.persistence
  - attack.t1505.003
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith: \MSExchangeMailboxReplication.exe
    TargetFilename|endswith:
      - .aspx
      - .asp
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7280c9f3-a5af-45d0-916a-bc01cb4151c9
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL