Windows MSExchangeMailboxReplication .aspx/.asp File Writes Indicating Web Shell Upload
Alerts when MSExchangeMailboxReplication.exe writes .asp or .aspx files on Windows, indicating potentially malicious server-side script drops.
- Product
- windows
- Category
- file_event
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-02-25
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags instances where MSExchangeMailboxReplication.exe writes files ending in .aspx or .asp to disk. Such extensions are commonly associated with server-side script and can indicate an attempt to deploy a web-accessible backdoor. It relies on Windows file event telemetry that records the executing image path and the target filename written to disk.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows MSExchangeMailboxReplication .aspx/.asp File Writes Indicating Web Shell Upload
id: 2eb26282-71f4-4ec5-98a0-ba40378955aa
status: test
description: This rule flags instances where MSExchangeMailboxReplication.exe writes files ending in .aspx or .asp to disk. Such extensions are commonly associated with server-side script and can indicate an attempt to deploy a web-accessible backdoor. It relies on Windows file event telemetry that records the executing image path and the target filename written to disk.
references:
- https://redcanary.com/blog/blackbyte-ransomware/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_exchange_aspx_write.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-02-25
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1505.003
logsource:
product: windows
category: file_event
detection:
selection:
Image|endswith: \MSExchangeMailboxReplication.exe
TargetFilename|endswith:
- .aspx
- .asp
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 7280c9f3-a5af-45d0-916a-bc01cb4151c9
type: derived