Exchange Server ProxyLogon URIs

id: bcbebbae-d59a-4692-b138-93434bccf3db
name: Exchange Server ProxyLogon URIs
description: |
  'This query will detect paths suspicious associated with ProxyLogon exploitation'
requiredDataConnectors:
  - connectorId: AzureMonitor(IIS)
    dataTypes:
      - W3CIISLog
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
tags:
  - Exchange
query: |

  W3CIISLog
  //Exclude local addresses, using the ipv4_is_private operator
  | where ipv4_is_private(cIP) == false and  cIP !startswith "fe80" and cIP !startswith "::" and cIP !startswith "127."
  | where (csUriStem matches regex @"\/owa\/auth\/[A-Za-z0-9]{1,30}\.js") or (csUriStem matches regex @"\/ecp\/[A-Za-z0-9]{1,30}\.(js|flt|css)")
  | project TimeGenerated, sSiteName, csMethod, csUriStem, sPort, sIP, cIP, csUserAgent
  | extend timestamp = TimeGenerated, IPCustomEntity = cIP
entityMappings:
- entityType: NetworkConnection
  fieldMappings:
    - identifier: DestinationAddress
      columnName: sIP
    - identifier: DestinationPort
      columnName: sPort
    - identifier: SourceAddress
      columnName: cIP