Microsoft Exchange Server Cross-Site Scripting (XSS) Exploitation

let XSSPatterns = dynamic(['<script', 'javascript:', 'onerror=', 'onload=', 'eval(', 'document.cookie', 'alert(', 'String.fromCharCode', 'fromCharCode', '%3Cscript', '%6A%61%76%61%73%63%72%69%70%74']);
W3CIISLog
| where TimeGenerated > ago(24h)
| where csHost has_any ('exchange', 'owa', 'ecp', 'autodiscover')
| where csUriStem has_any ('/owa/', '/ecp/', '/ews/', '/autodiscover/')
| where (
    csUriQuery has_any (XSSPatterns)
    or csReferer has_any (XSSPatterns)
    or csUserAgent has_any (XSSPatterns)
)
| project TimeGenerated, csHost, csUriStem, csUriQuery, csReferer, csMethod, scStatus, cIp, csUserAgent, csUsername
| extend AlertSeverity = case(
    csUriQuery has 'document.cookie', 'Critical',
    csUriQuery has '<script', 'High',
    'Medium'
)
| order by TimeGenerated desc

index=iis OR index=exchange sourcetype=iis OR sourcetype=ms:iis:auto
| where (cs_uri_stem="/owa/*" OR cs_uri_stem="/ecp/*" OR cs_uri_stem="/ews/*" OR cs_uri_stem="/autodiscover/*")
| eval xss_in_query=if(match(cs_uri_query, "(?i)(<script|javascript:|onerror=|onload=|eval\\(|document\\.cookie|alert\\(|fromCharCode|%3Cscript|%6A%61%76%61)"), 1, 0)
| eval xss_in_referer=if(match(cs_referer, "(?i)(<script|javascript:|onerror=|onload=|eval\\(|document\\.cookie)"), 1, 0)
| eval xss_detected=if(xss_in_query=1 OR xss_in_referer=1, 1, 0)
| where xss_detected=1
| eval severity=case(
    match(cs_uri_query, "document\\.cookie"), "critical",
    match(cs_uri_query, "<script"), "high",
    1==1, "medium"
  )
| table _time, c_ip, cs_username, cs_uri_stem, cs_uri_query, cs_referer, sc_status, cs_user_agent, severity
| sort -_time

sequence by source.ip with maxspan=5m
  [network where event.dataset == "iis.access" and
   url.path : ("/owa/*", "/ecp/*", "/ews/*", "/autodiscover/*") and
   (
     url.query : ("*<script*", "*javascript:*", "*onerror=*", "*onload=*", "*eval(*", "*document.cookie*", "*fromCharCode*", "*%3Cscript*")
     or http.request.referrer : ("*<script*", "*javascript:*", "*onerror=*")
   )
  ]
  [network where event.dataset == "iis.access" and
   url.path : ("/owa/*", "/ecp/*") and
   http.response.status_code == 200
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  URL,
  'XSS Payload Detected' AS detection_reason,
  CASE
    WHEN URL LIKE '%document.cookie%' THEN 'Critical'
    WHEN URL LIKE '%<script%' THEN 'High'
    ELSE 'Medium'
  END AS severity
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) ILIKE '%IIS%'
  AND (
    URL LIKE '%/owa/%'
    OR URL LIKE '%/ecp/%'
    OR URL LIKE '%/ews/%'
    OR URL LIKE '%/autodiscover/%'
  )
  AND (
    URL ILIKE '%<script%'
    OR URL ILIKE '%javascript:%'
    OR URL ILIKE '%onerror=%'
    OR URL ILIKE '%onload=%'
    OR URL ILIKE '%eval(%'
    OR URL ILIKE '%document.cookie%'
    OR URL ILIKE '%fromCharCode%'
    OR URL ILIKE '%%3Cscript%'
  )
  AND STARTTIME > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=iis OR _sourceCategory=exchange/iis
| parse regex "(?<cs_uri_stem>/(?:owa|ecp|ews|autodiscover)/[^\s]*)"
| parse regex "(?<cs_uri_query>\?[^\s]*)"
| where (
    cs_uri_query matches /(?i)(<script|javascript:|onerror=|onload=|eval\(|document\.cookie|fromCharCode|%3Cscript)/
    or cs_uri_stem matches /(?i)(<script|javascript:|onerror=)/
  )
| fields _messageTime, _sourceHost, cs_uri_stem, cs_uri_query, src_ip
| eval severity = if(cs_uri_query matches /document\.cookie/, "critical", if(cs_uri_query matches /<script/, "high", "medium"))
| count by src_ip, cs_uri_stem, severity
| sort -_count

rule cve_2026_42897_exchange_xss {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects XSS exploitation attempts against Microsoft Exchange Server (CVE-2026-42897)"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-42897"
    tags = "cve-2026-42897, exchange, xss, kev"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.url != ""
    re.regex($e.target.url, `(?i)(/owa/|/ecp/|/ews/|/autodiscover/)`)
    re.regex($e.target.url, `(?i)(<script|javascript:|onerror=|onload=|eval\(|document\.cookie|fromCharCode|%3Cscript|%6A%61%76%61)`)

  condition:
    $e
}

#event_simpleName=NetworkReceiveAcceptIP
| event_platform=Win
| LocalPort in (80, 443)
| RemoteIP != null
| CommandLine != null
| CommandLine = /(?i)(w3wp\.exe|inetinfo\.exe)/
| join {
    #event_simpleName=ProcessRollup2
    | ImageFileName = /(?i)(w3wp\.exe)/
    | ParentBaseFileName = /(?i)(svchost\.exe)/
  } [RemoteIP, LocalPort]
| search CommandLine=/(?i)(onerror=|onload=|<script|javascript:|document\.cookie|eval\(|fromCharCode)/
| table _time, ComputerName, RemoteIP, LocalPort, CommandLine, UserName
| sort -_time