#OWASSRF new exploition of Exchange servers using OWA as initial entry (full server pwnage with CVE-2022-41080 OWASSRF and CVE-2022-41082 PS RCE). See #ProxyNotShell differences below. This was found during investigations into Play ransomware intrusions.

TLDR: Mitigations and Response:
- ensure to patch November’s Exchange CU. Re: KB5019758
- URL rewrite mitigation for ProxyNotShell not valid protection here.
- triage Exchange servers with this PowerShell script to search for IOCs https://github.com/CrowdStrike/OWASSRF

More information available here;
https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/ #dfir