title: Exchange Set OabVirtualDirectory ExternalUrl Property
author: Jose Rodriguez @Cyb3rPandaH
date: 2021/03/15
description: Rule to detect an adversary setting OabVirtualDirectory External URL
  property to a script in Exchange Management log
detection:
  SELECTION_1:
  - Set-OabVirtualDirectory
  SELECTION_2:
  - ExternalUrl
  SELECTION_3:
  - Page_Load
  SELECTION_4:
  - script
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3 and SELECTION_4)
falsepositives:
- Unknown
id: 9db37458-4df2-46a5-95ab-307e7f29e675
level: high
logsource:
  product: windows
  service: msexchange-management
modified: 2021/11/15
references:
- https://twitter.com/OTR_Community/status/1371053369071132675
status: experimental
tags:
- attack.persistence
- attack.t1505.003
ruletype: SIGMA