Name:Exchange PowerShell Abuse via SSRF id:29228ab4-0762-11ec-94aa-acde48001122 version:4 date:2024-10-17 author:Michael Haag, Splunk status:experimental type:TTP Description:The following analytic detects suspicious behavior indicative of ProxyShell exploitation against on-premise Microsoft Exchange servers. It identifies HTTP POST requests to `autodiscover.json` containing `PowerShell` in the URI, leveraging server-side request forgery (SSRF) to access backend PowerShell. This detection uses Exchange server logs ingested into Splunk. Monitoring this activity is crucial as it may indicate an attacker attempting to execute commands or scripts on the Exchange server. If confirmed malicious, this could lead to unauthorized access, privilege escalation, or persistent control over the Exchange environment. Data_source:
search:`exchange` c_uri="*//autodiscover*" cs_uri_query="*PowerShell*" cs_method="POST" | stats count min(_time) as firstTime max(_time) as lastTime by dest, cs_uri_query, cs_method, c_uri | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `exchange_powershell_abuse_via_ssrf_filter`
how_to_implement:The following analytic requires on-premise Exchange to be logging to Splunk using the TA - https://splunkbase.splunk.com/app/3225. Ensure logs are parsed correctly, or tune the analytic for your environment. known_false_positives:Limited false positives, however, tune as needed. References: -https://github.com/GossiTheDog/ThreatHunting/blob/master/AzureSentinel/Exchange-Powershell-via-SSRF -https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html -https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1 drilldown_searches:
: tags: analytic_story: - 'ProxyShell' - 'BlackByte Ransomware' - 'ProxyNotShell' asset_type:Endpoint confidence:100 impact:80 message:Activity related to ProxyShell has been identified on $dest$. Review events and take action accordingly. mitre_attack_id: - 'T1190' - 'T1133' observable: name:'dest' type:'Hostname' - role: - 'Victim' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' required_fields: - '_time' - 'dest' - 'cs_uri_query' - 'cs_method' - 'c_uri' risk_score:80 security_domain:endpoint
