Suspicious File Drop by Exchange

Severity: medium
Author: Florian Roth (Nextron Systems)
Source: upstream

Detects suspicious file type dropped by an Exchange component in IIS

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application
Persistence	`T1505.003` Server Software Component: Web Shell

Event coverage

Provider	Event ID	Title
Sysmon	11	FileCreate

Stages and Predicates

Stage 1: `all of selection`

CommandLine|contains: MSExchange
Image|endswith: '\w3wp.exe'

Stage 2: `all of selection_types`

or:
TargetFilename|endswith: .ashx
TargetFilename|endswith: .asp
TargetFilename|endswith: .aspx
TargetFilename|endswith: .bat
TargetFilename|endswith: .dll
TargetFilename|endswith: .exe
TargetFilename|endswith: .ps1
TargetFilename|endswith: .vbs

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`MSExchange` corpus 3 (sigma 3)
`Image`	ends_with	`\w3wp.exe` corpus 6 (sigma 6)
`TargetFilename`	ends_with	`.ashx` corpus 3 (sigma 3) `.asp` corpus 4 (sigma 4) `.aspx` corpus 5 (sigma 5) `.bat` corpus 15 (sigma 15) `.dll` corpus 21 (sigma 21) `.exe` corpus 18 (sigma 18) `.ps1` corpus 15 (sigma 15) `.vbs` corpus 16 (sigma 16)

Neighbors

Stricter alternatives (narrower than this rule)

The rules below may be useful if you find the current rule is too noisy / lacks specificity.

Suspicious ASPX File Drop by Exchange [sigma] (adds 1 filter) (first-stage match only; downstream stages may differ)