splunk_escuTTP

Exchange PowerShell Abuse via SSRF

The following analytic detects suspicious behavior indicative of ProxyShell exploitation against on-premise Microsoft Exchange servers. It identifies HTTP POST requests to `autodiscover.json` containing `PowerShell` in the URI, leveraging server-side request forgery (SSRF) to access backend PowerShell. This detection uses Exchange server logs ingested into Splunk. Monitoring this activity is crucial as it may indicate an attacker attempting to execute commands or scripts on the Exchange server. If confirmed malicious, this could lead to unauthorized access, privilege escalation, or persistent control over the Exchange environment.

MITRE ATT&CK

T1190 T1133

initial-accesspersistence

Detection Query

`windows_exchange_iis` c_uri="*//autodiscover*" cs_uri_query="*PowerShell*" cs_method="POST"
  | stats count min(_time) as firstTime max(_time) as lastTime
    BY dest, cs_uri_query, cs_method,
       c_uri
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`
  | `exchange_powershell_abuse_via_ssrf_filter`

Author

Michael Haag, Splunk

Created

2026-03-10

References

Tags

ProxyShellBlackByte RansomwareProxyNotShellSeashell Blizzard

Raw Content

name: Exchange PowerShell Abuse via SSRF
id: 29228ab4-0762-11ec-94aa-acde48001122
version: 10
date: '2026-03-10'
author: Michael Haag, Splunk
status: experimental
type: TTP
description: The following analytic detects suspicious behavior indicative of ProxyShell exploitation against on-premise Microsoft Exchange servers. It identifies HTTP POST requests to `autodiscover.json` containing `PowerShell` in the URI, leveraging server-side request forgery (SSRF) to access backend PowerShell. This detection uses Exchange server logs ingested into Splunk. Monitoring this activity is crucial as it may indicate an attacker attempting to execute commands or scripts on the Exchange server. If confirmed malicious, this could lead to unauthorized access, privilege escalation, or persistent control over the Exchange environment.
data_source: []
search: |-
    `windows_exchange_iis` c_uri="*//autodiscover*" cs_uri_query="*PowerShell*" cs_method="POST"
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest, cs_uri_query, cs_method,
           c_uri
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `exchange_powershell_abuse_via_ssrf_filter`
how_to_implement: The following analytic requires on-premise Exchange to be logging to Splunk using the TA - https://splunkbase.splunk.com/app/3225. Ensure logs are parsed correctly, or tune the analytic for your environment.
known_false_positives: Limited false positives, however, tune as needed.
references:
    - https://github.com/GossiTheDog/ThreatHunting/blob/master/AzureSentinel/Exchange-Powershell-via-SSRF
    - https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
    - https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1
rba:
    message: Activity related to ProxyShell has been identified on $dest$. Review events and take action accordingly.
    risk_objects:
        - field: dest
          type: system
          score: 50
    threat_objects: []
tags:
    analytic_story:
        - ProxyShell
        - BlackByte Ransomware
        - ProxyNotShell
        - Seashell Blizzard
    asset_type: Endpoint
    mitre_attack_id:
        - T1190
        - T1133
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: endpoint