Exchange OWA Exposure: How to Scan Log Files for Indicators of Compromise
If your organization runs an OWA server exposed to the internet, you may be compromised. Here is how to scan Exchange log files for indicators of compromise and what to do if you find them.
By Tom Brennan
If your organization runs an Outlook Web Access (OWA) server exposed to the internet, you need to conduct a log review immediately. Exchange Server has been one of the most heavily exploited enterprise software platforms with vulnerabilities including ProxyLogon, ProxyShell, and ProxyNotShell enabling unauthenticated remote code execution.
Where to Look
IIS Logs
IIS logs at C:\inetpub\logs\LogFiles\W3SVC1\ are the primary source. Key indicators include: POST requests to autodiscover endpoints, requests to /ecp/ from unexpected IP addresses, 8-character alphanumeric strings in URL paths (characteristic of webshell staging), and HTTP 200 responses to unusual POST requests.
Exchange Diagnostic Logs
Exchange logs capture OWA authentication events, EWS requests, and PowerShell remoting sessions. Look for authentication from unexpected IP addresses and PowerShell remoting sessions not initiated by your IT team.
What to Do If You Find IOCs
Do not attempt remediation without first preserving evidence. Take memory and disk images of affected systems before making any changes. Engage incident response support immediately. Proactive Risk provides incident response services including Exchange compromise investigation. If you believe you may be compromised, contact us at help@proactiverisk.com.
Free Investigation Resources
Accelerate your IOC investigation and incident response with Proactive Risk's free resources, available in the Downloads library:
- OSINT Browser Bookmarks — a curated collection of investigation tools, search engines, and open-source intelligence resources
- Security Incident Response Plan (SIRP) Template — a ready-to-use incident response plan template covering detection, containment, eradication, and recovery