CVE-2020-0688 Exchange Exploitation via Web Log

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•22

Detects exploitation attempts of the Microsoft Exchange vulnerability CVE-2020-0688. This vulnerability allows for remote code execution due to improper validation of cmdlet arguments. The rule specifically looks for GET requests to '/ecp/' or '/owa/' paths containing '__VIEWSTATE=' in the query string, which is indicative of the exploitation attempt.