Hub configuration

Name: Microsoft Exchange CVE-2022-41082
Author: crowdsecurity

More info

Microsoft Exchange CVE-2022-41082 Configuration by crowdsecurity | CrowdSec Hub

« Microsoft Exchange CVE-2022-41082 »
v0.4 by crowdsecurity / CVE-2022-41082
Attack scenarioexchangeNot spoofableHigh confidence

Detect CVE-2022-41082 exploits

Installation

cscli scenarios install crowdsecurity/CVE-2022-41082

YAML Configuration

1type: trigger
2#debug: true
3name: crowdsecurity/CVE-2022-41082
4description: "Detect CVE-2022-41082 exploits"
5filter: |
6  Upper(evt.Meta.http_path) contains Upper('/autodiscover/autodiscover.json') &&
7  Upper(evt.Parsed.http_args) contains Upper('powershell')
8
9blackhole: 1m
10groupby: "evt.Meta.source_ip"
11labels:
12  type: exploit
13  remediation: true
14  classification:
15    - attack.T1595
16    - attack.T1190
17    - cve.CVE-2022-41082
18  spoofable: 0
19  confidence: 3
20  behavior: "http:exploit"
21  service: exchange
22  label: "Microsoft Exchange CVE-2022-41082"
23

Hub configuration

« Microsoft Exchange CVE-2022-41082 »v0.4 by crowdsecurity / CVE-2022-41082Attack scenarioCVE-2022-41082exchangeNot spoofableHigh confidenceMITRE:T1595MITRE:T1190

« Microsoft Exchange CVE-2022-41082 »
v0.4 by crowdsecurity / CVE-2022-41082
Attack scenarioexchangeNot spoofableHigh confidence