Скачать или смотреть SA - SOC175-125 - PowerShell Found in Requested URL - Possible CVE-2022-41082 Exploitation

Working on the Security Analyst Path in the Lets Defend platform with an alert for "SOC175 - PowerShell Found in Requested URL - Possible CVE-2022-41082 Exploitation".

⭐ This zero-day vulnerability (CVE-2022-41082) is being actively exploited in the wild.

EventID: 125
Event Time: Sept. 30, 2022, 7:19 a.m.
Rule: SOC175 - PowerShell Found in Requested URL - Possible CVE-2022-41082 Exploitation
Level: Security Analyst
Hostname: Exchange Server 2
Destination IP Address: 172.16.20.8
Log Source: IIS
Source IP Address: 58.237.200.6
Request URL: /autodiscover/[email protected]/owa/&Email=autodiscover/autodiscover.json%[email protected]&Protocol=XYZ&FooProtocol=Powershell
HTTP Method: GET
User-Agent: Mozilla/5.0 zgrab/0.x
Action: Blocked
Alert Trigger Reason: Request URL Contains PowerShell


NOTES:
https://www.virustotal.com/gui/ip-add...
https://www.talosintelligence.com/rep...
https://otx.alienvault.com/indicator/...
https://exchange.xforce.ibmcloud.com/...
https://viz.greynoise.io/ip/58.237.200.6

https://unit42.paloaltonetworks.com/p...
https://www.bleepingcomputer.com/news...