From b460dedbca429b22f095e920dca598d9d8de13c0 Mon Sep 17 00:00:00 2001
From: Brandon Murphy <4827852+zoomequipd@users.noreply.github.com>
Date: Fri, 4 Sep 2026 13:08:04 -0500
Subject: [PATCH 1/2] Create body_cve_2026_42897.yml

---
 detection-rules/body_cve_2026_42897.yml | 36 +++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 detection-rules/body_cve_2026_42897.yml

diff --git a/detection-rules/body_cve_2026_42897.yml b/detection-rules/body_cve_2026_42897.yml
new file mode 100644
index 00000000000..3734781da11
--- /dev/null
+++ b/detection-rules/body_cve_2026_42897.yml
@@ -0,0 +1,36 @@
+name: "Body: CVE-2026-42897 Exchange OWA stored XSS"
+description: "Detects messages exploiting CVE-2026-42897, a stored XSS vulnerability in on-premises Exchange Outlook Web Access (OWA). The exploit embeds Base64-encoded JavaScript payload fragments after URL fragment identifiers (#) within data URI image src attributes, with a malformed img tag onload/onerror handler that reassembles and executes the fragments via eval(atob(...)). Detection covers both the delivery technique (img tags with event handlers combined with base64 data after # fragments) and implant content (OWAReaper-specific function names and API calls decoded from base64 within img tag src attributes). Simply opening the message in OWA's reading pane can trigger execution."
+type: "rule"
+severity: "critical"
+references:
+  - "https://www.resecurity.com/blog/article/inside-owareaper-how-cve-2026-42897-enables-persistent-exchange-mailbox-compromise"
+  - "https://www.proofpoint.com/us/blog/threat-insight/cleaning-out-inboxes-ta488-comes-outlook-another-half-click-exploit"
+source: |
+  type.inbound
+  and any(html.xpath(body.html, '//img[contains(@src,"data:image")]').nodes,
+          (
+            regex.icontains(.raw, '#[A-Za-z0-9+/=]{20,}')
+            and regex.icontains(.raw, 'on(?:load|error)')
+            and strings.icontains(.raw, 'eval(', 'atob(', 'Function(')
+          )
+          or (
+            any(strings.scan_base64(.raw),
+                strings.icontains(.,
+                                  'owaRequest',
+                                  'GetClientAccessToken',
+                                  'owa_offline_db',
+                                  'PageDataPayload',
+                                  'UpdateFolder'
+                )
+            )
+          )
+  )
+attack_types:
+  - "Malware/Ransomware"
+tactics_and_techniques:
+  - "Evasion"
+  - "Exploit"
+  - "Scripting"
+detection_methods:
+  - "Content analysis"
+  - "HTML analysis"

From 837705a102da9b4f63c1fa5cff05e5e653a650ce Mon Sep 17 00:00:00 2001
From: CI Bot <hello@sublimesecurity.com>
Date: Fri, 4 Sep 2026 18:10:34 +0000
Subject: [PATCH 2/2] Auto-format MQL and add rule IDs

---
 detection-rules/body_cve_2026_42897.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detection-rules/body_cve_2026_42897.yml b/detection-rules/body_cve_2026_42897.yml
index 3734781da11..5dc21b9a93e 100644
--- a/detection-rules/body_cve_2026_42897.yml
+++ b/detection-rules/body_cve_2026_42897.yml
@@ -34,3 +34,4 @@ tactics_and_techniques:
 detection_methods:
   - "Content analysis"
   - "HTML analysis"
+id: "e58b744f-fabe-530f-9e1a-3030d622dac7"