Exchange Exploitation Used by HAFNIUM

title: Exchange Exploitation Used by HAFNIUM
id: 67bce556-312f-4c81-9162-c3c9ff2599b2
status: test
description: Detects exploitation attempts in Exchange server logs as described in blog posts reporting on HAFNIUM group activity
references:
    - https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
    - https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
author: Florian Roth (Nextron Systems)
date: 2021-03-03
modified: 2023-01-02
tags:
    - attack.initial-access
    - attack.t1190
    - attack.g0125
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection_1:
        cs-method: 'POST'
        cs-uri-query|contains: '/owa/auth/Current/themes/resources/'
    selection_2:
        cs-method: 'POST'
        cs-uri-query|contains: '/owa/auth/Current/'
        cs-user-agent:
            - 'DuckDuckBot/1.0;+(+http://duckduckgo.com/duckduckbot.html)'
            - 'facebookexternalhit/1.1+(+http://www.facebook.com/externalhit_uatext.php)'
            - 'Mozilla/5.0+(compatible;+Baiduspider/2.0;++http://www.baidu.com/search/spider.html)'
            - 'Mozilla/5.0+(compatible;+Bingbot/2.0;++http://www.bing.com/bingbot.htm)'
            - 'Mozilla/5.0+(compatible;+Googlebot/2.1;++http://www.google.com/bot.html'
            - 'Mozilla/5.0+(compatible;+Konqueror/3.5;+Linux)+KHTML/3.5.5+(like+Gecko)+(Exabot-Thumbnails)'
            - 'Mozilla/5.0+(compatible;+Yahoo!+Slurp;+http://help.yahoo.com/help/us/ysearch/slurp)'
            - 'Mozilla/5.0+(compatible;+YandexBot/3.0;++http://yandex.com/bots)'
            - 'Mozilla/5.0+(X11;+Linux+x86_64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/51.0.2704.103+Safari/537.36'
    selection_3:
        cs-uri-query|contains: '/ecp/'
        cs-method: 'POST'
        cs-user-agent:
            - 'ExchangeServicesClient/0.0.0.0'
            - 'python-requests/2.19.1'
            - 'python-requests/2.25.1'
    selection_4:
        cs-uri-query|contains:
            - '/aspnet_client/'
            - '/owa/'
        cs-method: 'POST'
        cs-user-agent:
            - 'antSword/v2.1'
            - 'Googlebot/2.1+(+http://www.googlebot.com/bot.html)'
            - 'Mozilla/5.0+(compatible;+Baiduspider/2.0;++http://www.baidu.com/search/spider.html)'
    selection_5:
        cs-uri-query|contains:
            - '/owa/auth/Current/'
            - '/ecp/default.flt'
            - '/ecp/main.css'
        cs-method: 'POST'
    selection_6:
        cs-method: 'POST'
        cs-uri-query|contains|all:
            - '/ecp/'
            - '.js'
    condition: 1 of selection_*
falsepositives:
    - Legitimate access to other web applications that use the same folder names as Exchange (e.g. owa, ecp) but are not Microsoft Exchange related
level: high