Hunting for the Recent Attacks Targeting Microsoft Exchange

This post is also available in: 日本語 (Japanese)

Executive Summary

March 16 Update: A detailed timeline of protections released across our Cortex XDR products has been added to this blog post.

On March 2, 2021, Volexity reported the in-the-wild exploitation of four Microsoft Exchange Server vulnerabilities: CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065. As a result of these vulnerabilities being exploited, adversaries can access Microsoft Exchange servers and allow the installation of additional tools to facilitate long-term access into victims' environments. There has also been a report of multiple threat actors leveraging these zero-day vulnerabilities, meaning post-exploitation activity may vary depending on the purpose of the different threat actors.

These vulnerabilities affect the following Microsoft Exchange Server versions:

• Microsoft Exchange 2013.
• Microsoft Exchange 2016.
• Microsoft Exchange 2019.

Microsoft has released an emergency out-of-band security update to patch these vulnerabilities. We strongly advise immediately updating all Microsoft Exchange servers to the latest available patched versions released by Microsoft.

This blog will help you proactively search for related indicators of compromise (IOCs) using Cortex XDR.

Hunting for this Attack in Your Environment

Review existing alerts for signs of compromise

Leveraging the existing alerts in Cortex XDR, we suggest hunting for alerts from the IIS process, w3wp.exe, and the exchange worker process, UMWorkerProcess.exe.

From there, we can pivot to a causality screen to drill deeper:

Hunt for the attack using XQL Search in Cortex XDR:

The China Chopper webshell has very distinct command line patterns that use [s]&cd&echo [e].You can look for these patterns with the following query:

Microsoft Internet Information Server (IIS) dropping ASPX files into Exchange and generic IIS loading locations is a good indication of a webshell drop:

Running discovery commands from IIS processes is a good indication of an attacker trying to get the lay of the land. Hunt for such activities using this query:

The attackers use compression and memory dumps to stage exfiltration and credential access using C:\programdata as the staging location. Hunt for servers doing this activity using this query:

The Exchange worker process does not usually create subprocesses and one of the exploit targets this process. This XQL query in Cortex XDR will help hunt for such cases:

Hunt and respond with Cortex XSOAR

Cortex XSOAR has released a playbook called “HAFNIUM - Exchange 0-day exploits”. You can find it in the Rapid Breach Response content pack on our Cortex XSOAR Marketplace. The fully automated playbook will execute the following:

• Collect indicators to be used in your threat hunting processes
• Query firewall logs to detect malicious network activity
• Search endpoint logs for malicious activity to detect compromised hosts; if Cortex XDR is enabled, the playbook will also search for alerts detailed above
• Block indicators in various third-party tools

Cortex XDR alerts that detect this attack

Observed Activities

We have seen attackers create webshell files on these paths:

We have seen attackers execute the following commands:

Detailed Protection Timeline

* On post-exploitation activities such as Mimikatz usage prevention.

** Preventing the execution of attacks from the China Chopper webshells.

*** Preventing writing of webshells by exploited IIS Servers.

Conclusion

Due to the alarming activity of threat actors exploiting these zero-day vulnerabilities against vulnerable Microsoft Exchange servers, we strongly advise immediately updating all Microsoft Exchange servers to the latest available patched versions released by Microsoft.

We also advise updating to the latest product and content version, and hunting for threats using the supplied XQL queries and the existing protection mechanisms within the product.

Read the Unit 42 Threat Assessment here.