OwaAuth
- ID
- S0072
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 25 Apr 2025
OwaAuth is a Web shell and credential stealer deployed to Microsoft Exchange servers that appears to be exclusively used by Threat Group-3390. [1]
Techniques used (8)
- T1036.005 Match Legitimate Resource Name or Location
- T1056.001 Keylogging
- T1070.006 Timestomp
- T1071.001 Web Protocols
- T1083 File and Directory Discovery
- T1505.003 Web Shell
- T1505.004 IIS Components
- T1560.003 Archive via Custom Method