1type: trigger
2#debug: true
3name: crowdsecurity/CVE-2022-41082
4description: "Detect CVE-2022-41082 exploits"
5filter: |
6  Upper(evt.Meta.http_path) contains Upper('/autodiscover/autodiscover.json') &&
7  Upper(evt.Parsed.http_args) contains Upper('powershell')
8
9blackhole: 1m
10groupby: "evt.Meta.source_ip"
11labels:
12  type: exploit
13  remediation: true
14  classification:
15    - attack.T1595
16    - attack.T1190
17    - cve.CVE-2022-41082
18  spoofable: 0
19  confidence: 3
20  behavior: "http:exploit"
21  service: exchange
22  label: "Microsoft Exchange CVE-2022-41082"
23