Exchange process writing aspx files

BIOC High

Exchange process writing aspx files

An exchange process is writing to .aspx files. This may be an actor dropping web shells.

Module:: Platform Analytics
Agent event type:: File
Category:: Infiltration
Status:: Enabled

ATT&CK tactics: Initial Access (TA0001) Command and Control (TA0011)

ATT&CK techniques: Exploit Public-Facing Application (T1190) Application Layer Protocol: Web Protocols (T1071.001)

Indicator:

File action type = create , write AND file path =~ (\\inetpub\\wwwroot\\aspnet_client\\|\\frontend\\httpproxy\\owa\\auth\\|\\frontend\\httpproxy\\ecp\\auth\\).*\.aspx Process initiated by = UMWorkerProcess.exe , w3wp.exe

Preventable: yes