Exchange PowerShell Abuse via SSRF

name: Exchange PowerShell Abuse via SSRF
id: 29228ab4-0762-11ec-94aa-acde48001122
version: 11
creation_date: '2021-09-01'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: experimental
type: TTP
description: The following analytic detects suspicious behavior indicative of ProxyShell exploitation against on-premise Microsoft Exchange servers. It identifies HTTP POST requests to `autodiscover.json` containing `PowerShell` in the URI, leveraging server-side request forgery (SSRF) to access backend PowerShell. This detection uses Exchange server logs ingested into Splunk. Monitoring this activity is crucial as it may indicate an attacker attempting to execute commands or scripts on the Exchange server. If confirmed malicious, this could lead to unauthorized access, privilege escalation, or persistent control over the Exchange environment.
data_source: []
search: |-
    `windows_exchange_iis` c_uri="*//autodiscover*" cs_uri_query="*PowerShell*" cs_method="POST"
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest, cs_uri_query, cs_method,
           c_uri
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `exchange_powershell_abuse_via_ssrf_filter`
how_to_implement: The following analytic requires on-premise Exchange to be logging to Splunk using the TA - https://splunkbase.splunk.com/app/3225. Ensure logs are parsed correctly, or tune the analytic for your environment.
known_false_positives: Limited false positives, however, tune as needed.
references:
    - https://github.com/GossiTheDog/ThreatHunting/blob/master/AzureSentinel/Exchange-Powershell-via-SSRF
    - https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
    - https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1
finding:
    title: Activity related to ProxyShell has been identified on $dest$. Review events and take action accordingly.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - ProxyShell
    - BlackByte Ransomware
    - ProxyNotShell
    - Seashell Blizzard
asset_type: Endpoint
mitre_attack_id:
    - T1190
    - T1133
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint