From 06b6d968191fbd1d44bbb2f90d7175f87f931c09 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 1 Sep 2021 12:26:03 -0600
Subject: [PATCH] Create exchange_powershell_abuse_via_ssrf.yml

---
 .../exchange_powershell_abuse_via_ssrf.yml    | 61 +++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 detections/experimental/endpoint/exchange_powershell_abuse_via_ssrf.yml

diff --git a/detections/experimental/endpoint/exchange_powershell_abuse_via_ssrf.yml b/detections/experimental/endpoint/exchange_powershell_abuse_via_ssrf.yml
new file mode 100644
index 0000000000..1d1a266143
--- /dev/null
+++ b/detections/experimental/endpoint/exchange_powershell_abuse_via_ssrf.yml
@@ -0,0 +1,61 @@
+name: Exchange PowerShell Abuse via SSRF
+id: 29228ab4-0762-11ec-94aa-acde48001122
+version: 1
+date: '2021-08-27'
+author: Michael Haag, Splunk
+type: TTP
+datamodel: []
+description: 'This analytic identifies suspicious behavior related to ProxyShell against on-premise Microsoft Exchange servers. \
+  
+  Modification of this analytic is requried to ensure fields are mapped accordingly. \
+  
+  A suspicious event will have `PowerShell`, the method `POST` and `autodiscover.json`. This is indicative of accessing PowerShell on the back end of Exchange with SSRF. \
+
+  An event will look similar to `POST /autodiscover/autodiscover.json a=dsxvu@fnsso.flq/powershell/?X-Rps-CAT=VgEAVAdXaW5kb3d...` (abbreviated) \
+  
+  Review the source attempting to perform this activity against your environment. In addition, review PowerShell logs and access recently granted to Exchange roles.'
+search: '| sourcetype="MSWindows:IIS" c_uri="*//autodiscover.json*" cs_uri_query="*PowerShell*" cs_method="POST" 
+  | stats count min(_time) as firstTime max(_time) as lastTime by dest, cs_uri_query, cs_method, c_uri
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `exchange_powershell_abuse_via_ssrf_filter`'
+how_to_implement: The following analytic requires on-premise Exchange to be logging to Splunk using the TA - https://splunkbase.splunk.com/app/3225. Ensure logs are parsed correctly, or tune the analytic for your environment.
+known_false_positives: Limited false positives, however, tune as needed.
+references:
+  - https://github.com/GossiTheDog/ThreatHunting/blob/master/AzureSentinel/Exchange-Powershell-via-SSRF
+  - https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
+  - https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1
+tags:
+  analytic_story:
+  - ProxyShell
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/exchange-events.json
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1190
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - cs_uri_query
+  - cs_method
+  - c_uri
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: Activity related to ProxyShell has been identified on $dest$. Review events and take action accordingly.
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  
\ No newline at end of file