Microsoft Exchange Server UM Spawning Suspicious Processes

This detection rule identifies suspicious processes spawned by the Microsoft Exchange Server Unified Messaging (UM) service, a behavior indicative of potential exploitation of CVE-2021-26857. The Unified Messaging service integrates voice messaging with email, providing users access to voicemails via their inbox. Attackers exploit vulnerabilities to execute unauthorized processes, potentially leading to system compromise. The rule flags unusual processes initiated by UM services, excluding known legitimate executables like werfault.exe and legitimate UMWorkerProcess.exe paths, to detect potential exploitation attempts. This activity was initially observed in March 2021 during the Hafnium attacks targeting Exchange servers. Defenders should be aware of unusual processes being launched from the UM service, as this is not typical behavior.

Attack Chain

1. Attacker exploits CVE-2021-26857 or a similar vulnerability in Microsoft Exchange Server.
2. Successful exploitation allows the attacker to execute arbitrary code on the Exchange Server.
3. The attacker leverages the Unified Messaging service (UMService.exe or UMWorkerProcess.exe) as a vehicle to launch malicious processes.
4. A suspicious process (e.g., cmd.exe, powershell.exe, or other unauthorized executable) is spawned by the UM service.
5. The malicious process executes commands to perform reconnaissance, establish persistence, or move laterally within the network.
6. The attacker might attempt to dump credentials, install backdoors, or exfiltrate sensitive data.
7. The attacker moves laterally to other systems using compromised credentials or other exploits.
8. The ultimate objective is to gain complete control of the network, steal sensitive data, or deploy ransomware.

Impact

Successful exploitation of Exchange Server vulnerabilities and subsequent spawning of malicious processes can lead to complete compromise of the Exchange server and potentially the entire Active Directory domain. Attackers can gain access to sensitive emails, customer data, and internal documents. The initial wave of attacks exploiting CVE-2021-26857 impacted thousands of organizations globally. Successful attacks can result in data breaches, financial losses, and reputational damage.

Recommendation

• Deploy the Sigma rule "Microsoft Exchange Server UM Spawning Suspicious Processes" to detect unauthorized processes spawned by the UM service. Enable process creation logging on Windows servers (Sysmon or Windows Security Event Logs) to collect the necessary data for the rule to function.
• Review and update the exclusion list in the Sigma rule to account for legitimate processes spawned by the UM service in your specific environment. This will help reduce false positives.
• Apply the latest security patches and updates to Microsoft Exchange Server to address CVE-2021-26857 and other known vulnerabilities.
• Monitor the command-line arguments of processes spawned by the UM service for suspicious activity.
• Investigate any alerts generated by the Sigma rule to determine the scope of the compromise and take appropriate remediation steps.
• Regularly review Exchange Server security logs for suspicious activity and indicators of compromise.