CVE-2020-0688 Microsoft Exchange RCE Exploitation via Eventlog

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

Detects the exploitation of the Microsoft Exchange vulnerability CVE-2020-0688, which is a remote code execution vulnerability. The rule specifically looks for an 'Error' level EventID 4 from the 'MSExchange Control Panel' provider, combined with the presence of '__VIEWSTATE=' in the event data, indicating an attempt to exploit the vulnerability via the Eventlog.