This rule detects a CVE-2026-42897 stored XSS chain targeting on-premises Exchange OWA. It focuses on two related facets of the exploit: delivery and implant content within HTML email payloads. Delivery technique: the rule looks for HTML img tags whose src contains a data:image URI with fragments appended after a #, combined with event handlers (onload or onerror) that reassemble the payload and execute it via eval(atob(...)) or through Function(...). Implant/content indicators: base64-encoded payloads embedded in the img src attribute that, when decoded, reveal OWAReaper-related constructs such as owaRequest, GetClientAccessToken, owa_offline_db, PageDataPayload, and UpdateFolder. The rule triggers when either set of indicators is present, capturing both the exploitation path and the decoded content used by the malware. Execution can occur simply by opening the message in OWA’s reading pane, making this a high-severity, user-actionable threat.