Microsoft Exchange OWA Zero-Day (XSS): Active Exploitation and Mitigations

---
title: Potential Exchange OWA XSS Injection Attempt
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential XSS injection attempts in Exchange OWA access logs. Identifies common script tags and event handlers in URL query strings or headers which may indicate exploitation of the OWA vulnerability.
references:
 - https://www.bleepingcomputer.com/news/microsoft/microsoft-warns-of-exchange-zero-day-flaw-exploited-in-attacks/
author: Security Arsenal
date: 2024/08/15
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2024.xxxx
logsource:
  category: webserver
  product: iis
detection:
  selection:
    c-uri|contains:
      - '/owa/'
      - '/ecp/'
  filter_suspicious:
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - 'fromCharCode'
      - 'alert('
  condition: selection and filter_suspicious
falsepositives:
  - Legitimate testing or scanning activity (rare in production OWA)
level: high
---
title: Exchange Worker Process Spawning Shell
id: 9b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects the Exchange Backend process (w3wp.exe) spawning cmd.exe or powershell.exe. This behavior may indicate successful exploitation leading to arbitrary code execution.
references:
 - https://www.bleepingcomputer.com/news/microsoft/microsoft-warns-of-exchange-zero-day-flaw-exploited-in-attacks/
author: Security Arsenal
date: 2024/08/15
tags:
  - attack.execution
  - attack.t1059
  - cve.2024.xxxx
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
    ParentImage|contains: '\Exchange Server\'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate Exchange administrative scripts
level: critical

// Hunt for OWA XSS patterns in IIS Logs (via Syslog/CEF or DeviceEvents)
// Note: Adjust table names based on your ingestion method (e.g., Syslog, CommonSecurityLog)
Syslog
| where Facility contains "Exchange" or ProcessName contains "w3wp"
| extend RenderedDescription = tostring(SyslogMessage)
| where RenderedDescription has "/owa/" or RenderedDescription has "/ecp/"
| where RenderedDescription matches regex @"<script[^>]*>|javascript:|on(error|load)="
| project TimeGenerated, Computer, RenderedDescription, ProcessName
| extend Account = "IIS/Exchange"
| order by TimeGenerated desc
;

// Hunt for suspicious process spawns by Exchange Worker Process
DeviceProcessEvents  
| where InitiatingProcessFileName == "w3wp.exe"
| where FolderPath contains "Exchange"
| where FileName in ("cmd.exe", "powershell.exe", "pwsh.exe")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by Timestamp desc

-- Hunt for Exchange w3wp.exe spawning command shells
SELECT Pid, Parent.Pid AS ParentPid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Parent.Name =~ "w3wp.exe"
  AND Name =~ "cmd.exe" OR Name =~ "powershell.exe"
  AND Exe =~ "Exchange"

-- Hunt for IIS Log entries indicative of XSS (requires IIS log path)
SELECT FullPath, Mtime, Data
FROM glob(globs="*/inetpub/logs/LogFiles/W3SVC*.log")
WHERE read_file(filename=FullPath)
  =~ "<script"
  OR read_file(filename=FullPath) =~ "javascript:"

# Script to check if the Microsoft URL Rewrite mitigation is in place
# This is a common emergency mitigation for unpatched Exchange vulnerabilities

Import-Module WebAdministration

$RewriteModule = Get-WebModule -Name "RewriteModule"
if (-not $RewriteModule) {
    Write-Warning "URL Rewrite Module is not installed. Please install it to apply mitigations."
} else {
    Write-Host "URL Rewrite Module is installed." -ForegroundColor Green
}

# Check for specific mitigation rules (Adjust rule name based on Microsoft advisory)
$site = "Default Web Site"
$rules = Get-WebConfiguration -Filter "system.webServer/rewrite/rules" -PSPath "IIS:\Sites\$site"

if ($rules.Collection | Where-Object { $_.Name -like "* mitigation*" -or $_.Name -like "*CVE*" }) {
    Write-Host "Mitigation rules appear to be present on $site." -ForegroundColor Green
} else {
    Write-Warning "No explicit mitigation rules found for $site. Please apply the vendor-supplied URL Rewrite configuration immediately."
}