rule: HAFNIUM Exchange exploitation

rules/web/web_exchange_exploitation_hafnium.yml

@@ -0,0 +1,62 @@
+title: Exchange Exploitation Used by HAFNIUM
+id: 67bce556-312f-4c81-9162-c3c9ff2599b2
+status: experimental
+description: Detects CVE-2020-0688 Exploitation attempts
+references:
+  - https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
+  - https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
+author: Florian Roth
+date: 2021/03/03
+tags:
+    - attack.initial_access
+    - attack.t1190
+logsource:
+  category: webserver
+detection:
+  selection1:
+    cs-method: 'POST'
+    c-uri|contains: '/owa/auth/Current/themes/resources/'
+  selection2:
+    cs-method: 'POST'
+    c-uri|contains: '/owa/auth/Current/'
+    c-useragent:
+      - 'DuckDuckBot/1.0; (http://duckduckgo.com/duckduckbot.html)'
+      - 'facebookexternalhit/1.1 (http://www.facebook.com/externalhit_uatext.php)'
+      - 'Mozilla/5.0 (compatible; Baiduspider/2.0; http://www.baidu.com/search/spider.html)'
+      - 'Mozilla/5.0 (compatible; Bingbot/2.0; http://www.bing.com/bingbot.htm)'
+      - 'Mozilla/5.0 (compatible; Googlebot/2.1; http://www.google.com/bot.html'
+      - 'Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.5 (like Gecko) (Exabot-Thumbnails)'
+      - 'Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)'
+      - 'Mozilla/5.0 (compatible; YandexBot/3.0; http://yandex.com/bots)'
+      - 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36'
+  selection3:
+    c-uri|contains: '/ecp/'
+    cs-method: 'POST'
+    c-useragent:
+      - 'ExchangeServicesClient/0.0.0.0'
+      - 'python-requests/2.19.1'
+      - 'python-requests/2.25.1'
+  selection4:
+    c-uri|contains: 
+      - '/aspnet_client/'
+      - '/owa/'
+    cs-method: 'POST'  
+    c-useragent:
+      - 'antSword/v2.1'
+      - 'Googlebot/2.1 ( http://www.googlebot.com/bot.html)'
+      - 'Mozilla/5.0 (compatible; Baiduspider/2.0;  http://www.baidu.com/search/spider.html)'
+  selection5:
+    c-uri|contains: 
+      - '/owa/auth/Current/'
+      - '/ecp/default.flt'
+      - '/ecp/main.css'
+    cs-method: 'POST'
+  selection6:
+    cs-method: 'POST'
+    c-uri|contains|all:
+      - '/ecp/'
+      - '.js' 
+  condition: 1 of them
+falsepositives:
+  - Legitimate access to other web applications that use the same folder names as Exchange (e.g. owa, ecp) but are not Microsoft Exchange related
+level: high