Detection rules › Kusto Query Language

Exchange Worker Process Making Remote Call

Author
Microsoft Security Community
Source
upstream

'This query dynamically identifies Exchange servers and then looks for instances where the IIS worker process initiates a call out to a remote URL using either cmd.exe or powershell.exe. This behaviour was described as post-compromise behaviour following exploitation of CVE-2022-41040 and CVE-2022-41082, this pattern of activity was use to download additional tools to the server. This suspicious activity is generic.'

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059.001 Command and Scripting Interpreter: PowerShell, T1059.003 Command and Scripting Interpreter: Windows Command Shell

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4688A new process has been created.
Defender-DeviceProcessEvents9001000Process activity (any)

Stages and Predicates

Stage 1: source

DeviceProcessEvents

Stage 2: where

DeviceName eq "exchangeServers"

Stage 3: where

InitiatingProcessParentFileName eq "w3wp.exe"

Stage 4: where

InitiatingProcessFileName match ["cmd.exe", "powershell.exe"]

Stage 5: where

ProcessCommandLine match "suspiciousCmdLineKeywords"

Stage 6: project

Stage 7: extend

Stage 8: extend

Stage 9: extend

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
DeviceNamein
  • exchangeServers
InitiatingProcessFileNamematch
  • cmd.exe
  • powershell.exe
InitiatingProcessParentFileNameeq
  • w3wp.exe
ProcessCommandLinematch
  • suspiciousCmdLineKeywords