cve20200688_exchange_exploitation_via_web_log

rule cve20200688_exchange_exploitation_via_web_log {
 meta:
    author = "Florian Roth"
    description = "Detects the exploitation of Microsoft Exchange vulnerability as described in CVE-2020-0688  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/H5LSb8XN3A9d"
    version = "0.01"
    created = "2020/02/29"
    category = "webserver"
    mitre = "initial_access, t1190"

  events:
($selection1.network.http.method = "GET" and (re.regex($selection1.target.url, `.*/ecp/.*`) or re.regex($selection1.target.url, `.*/owa/.*`)) and re.regex($selection1.target.url, `.*__VIEWSTATE=.*`))

  condition:
    $selection1
}