Certificate Request Export to Exchange Webserver

Title: Certificate Request Export to Exchange Webserver
Status: test
Description:Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell
References:
  -https://twitter.com/GossiTheDog/status/1429175908905127938
Author: Max Altgelt (Nextron Systems)
Date: 2021-08-23
modified:2023-01-23
Tags:

• -'attack.persistence'
• -'attack.t1505.003'

Logsource:

• service: msexchange-management
• product: windows

Detection:
  keywords_export_command:
    |all:
      -'New-ExchangeCertificate'
      -' -GenerateRequest'
      -' -BinaryEncoded'
      -' -RequestFile'

  keywords_export_params:
    - '\\\\localhost\\C$'
    - '\\\\127.0.0.1\\C$'
    - 'C:\\inetpub'
    - '.aspx'
  condition:keywords_export_command and keywords_export_params
Falsepositives:
  -Unlikely
Level: critical