SOC175 — PowerShell Found in Requested URL — Possible CVE-2022–41082 Exploitation

SOC175 — PowerShell Found in Requested URL — Possible CVE-2022–41082 Exploitation

Event ID: 125
Platform: LetsDefend

Alert

EventID : 125
Event Time : Sep, 30, 2022, 07:19 AM
Rule : SOC175 - PowerShell Found in Requested URL - Possible CVE-2022-41082 Exploitation
Level : Security Analyst
Hostname : Exchange Server 2
Destination IP Address : 172.16.20.8
Log Source : IIS
Source IP Address : 58.237.200.6
Request URL : /@evil.com">autodiscover/autodiscover.json?@evil.com/owa/&Email=autodiscover/autodiscover.json%3f@evil.com&Protocol=XYZ&FooProtocol=Powershell
HTTP Method : GET
User-Agent : Mozilla/5.0 zgrab/0.x
Action : Blocked …

blue team cve-2022-41082 cybersecurity incident response letsdefendio