1
2name: crowdsecurity/vpatch-CVE-2022-41082
3description: "Microsoft Exchange - RCE (CVE-2022-41082)"
4rules:
5  - and:
6    - zones:
7      - METHOD
8      match:
9        type: equals
10        value: GET
11    - zones:
12      - URI
13      transform:
14      - lowercase
15      match:
16        type: endsWith
17        value: /autodiscover/autodiscover.json
18    - zones:
19      - URI_FULL
20      transform:
21      - lowercase
22      match:
23        type: contains
24        value: "powershell"
25labels:
26  type: exploit
27  service: http
28  confidence: 3
29  spoofable: 0
30  behavior: "http:exploit"
31  label: "Microsoft Exchange - RCE"
32  classification:
33   - cve.CVE-2022-41082
34   - attack.T1595
35   - attack.T1190
36   - cwe.CWE-502