Detect Microsoft Exchange Server Cross-Site Scripting (XSS) Exploitation in Splunk
Detects exploitation attempts targeting CVE-2026-42897, a Cross-Site Scripting (XSS) vulnerability in Microsoft Exchange Server. This KEV-listed vulnerability allows attackers to inject malicious scripts into Exchange web interfaces, potentially leading to session hijacking, credential theft, or further lateral movement within the environment. Detection focuses on anomalous HTTP requests to Exchange OWA/ECP endpoints containing XSS payloads, unexpected script execution from Exchange processes, and suspicious web request patterns indicative of active exploitation.
MITRE ATT&CK
SPL Detection Query
index=iis OR index=exchange sourcetype=iis OR sourcetype=ms:iis:auto
| where (cs_uri_stem="/owa/*" OR cs_uri_stem="/ecp/*" OR cs_uri_stem="/ews/*" OR cs_uri_stem="/autodiscover/*")
| eval xss_in_query=if(match(cs_uri_query, "(?i)(<script|javascript:|onerror=|onload=|eval\\(|document\\.cookie|alert\\(|fromCharCode|%3Cscript|%6A%61%76%61)"), 1, 0)
| eval xss_in_referer=if(match(cs_referer, "(?i)(<script|javascript:|onerror=|onload=|eval\\(|document\\.cookie)"), 1, 0)
| eval xss_detected=if(xss_in_query=1 OR xss_in_referer=1, 1, 0)
| where xss_detected=1
| eval severity=case(
match(cs_uri_query, "document\\.cookie"), "critical",
match(cs_uri_query, "<script"), "high",
1==1, "medium"
)
| table _time, c_ip, cs_username, cs_uri_stem, cs_uri_query, cs_referer, sc_status, cs_user_agent, severity
| sort -_timeDetects XSS exploitation attempts in Microsoft Exchange IIS logs by identifying requests to OWA/ECP/EWS endpoints with suspicious payload patterns in query strings or referrer headers.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Authorized vulnerability scans against Exchange that include XSS test payloads
- Penetration tests or red team operations against Exchange infrastructure
- Legitimate application traffic with URL-encoded characters resembling XSS patterns
- Security tooling that logs test payloads as part of WAF rule validation
Other platforms for CVE-2026-42897
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Basic Reflected XSS Probe Against Exchange OWA
Expected signal: IIS access log entry with HTTP GET or POST to /owa/auth/logon.aspx containing the URL-encoded XSS payload in cs-uri-query field; source IP of the test machine visible in c-ip field.
- Test 2Cookie-Stealing XSS Payload Delivery to Exchange ECP
Expected signal: IIS access log shows request to /ecp/ with onerror= and document.cookie in the query string, sc-status may be 200 or 400; network log may show outbound HTTP to attacker server if payload executes in a browser context.
- Test 3Encoded XSS Bypass Attempt Against Exchange Autodiscover
Expected signal: IIS access logs show multiple GET requests to /autodiscover/autodiscover.xml with encoded XSS strings in cs-uri-query; Windows PowerShell event log (Event ID 4104) may capture the script block execution.
Unlock Pro Content
Get the full detection package for CVE-2026-42897 including response playbook, investigation guide, and atomic red team tests.