https://feed.craftedsignal.io/products/microsoft-exchange-server/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 18:12:00 +0000https://feed.craftedsignal.io/briefs/2024-01-03-exchange-um-webshell/Wed, 03 Jan 2024 18:12:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-03-exchange-um-webshell/This rule detects suspicious file creations by the Microsoft Exchange Server Unified Messaging service, potentially indicative of exploitation of CVE-2021-26858, leading to web shell deployment for initial access, lateral movement, and persistence.This detection focuses on identifying suspicious file creation events triggered by the Microsoft Exchange Server Unified Messaging (UM) service, specifically UMWorkerProcess.exe and umservice.exe. The activity is linked to potential exploitation of CVE-2021-26858, a server-side request forgery (SSRF) vulnerability. The rule targets the creation of files with web-related extensions such as php, jsp, js, aspx, asmx, asax, cfm, and shtml within specific Microsoft Exchange Server directories. Successful exploitation allows attackers to establish a web shell, gaining unauthorized access, enabling lateral movement, and achieving persistence within the compromised environment. This activity was observed beginning in early 2021, with widespread targeting of Exchange servers.

Attack Chain

1. Attacker exploits CVE-2021-26858 or similar vulnerability in Exchange Server, gaining the ability to write arbitrary files.
2. The Exchange UM service (UMWorkerProcess.exe or umservice.exe) is leveraged to write malicious files.
3. A web shell file (e.g., malware.aspx, backdoor.php) is created in a directory accessible via HTTP, such as \inetpub\wwwroot\aspnet_client\, *\Microsoft\Exchange Server*\FrontEnd\HttpProxy\owa\auth\, or *\Microsoft\Exchange Server*\FrontEnd\HttpProxy\ecp\auth\.
4. The attacker accesses the web shell via a web browser, sending HTTP requests to the created file.
5. The web shell executes commands on the Exchange server, allowing the attacker to gather information, move laterally within the network, or establish persistence.
6. The attacker gains control over the Exchange server, potentially compromising sensitive data and services.
7. The attacker may use the compromised Exchange server to access other systems within the network, expanding their reach.

Impact

Compromised Microsoft Exchange servers can lead to the exposure of sensitive email communications, user credentials, and confidential business data. Successful exploitation and web shell deployment can grant attackers persistent access to the internal network, enabling lateral movement to other critical systems. The potential consequences include data theft, ransomware deployment, disruption of email services, and reputational damage. While the number of directly affected organizations is not specified in this brief, the broad adoption of Microsoft Exchange makes this a widespread concern.

Recommendation

• Deploy the Sigma rule "Microsoft Exchange Server UM Writing Suspicious Files" to your SIEM and tune for your environment to detect web shell creation (see below).
• Prioritize patching CVE-2021-26858 on all internet-facing Exchange servers immediately to prevent initial exploitation.
• Investigate any alerts generated by the Sigma rule, comparing suspicious file creations against established Microsoft baselines (see References).
• Enable Sysmon file creation logging with the appropriate event ID to ensure adequate telemetry for the Sigma rules to function.
• Consult Microsoft's Exchange support repository for additional tools and guidance on detecting and mitigating Exchange vulnerabilities (see References).

]]>mediumthreatexchangewebshellcve-2021-26858initial-accesshttps://feed.craftedsignal.io/briefs/2024-01-activesync-mailbox-modification/Tue, 02 Jan 2024 15:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-activesync-mailbox-modification/An adversary may use the Exchange PowerShell cmdlet, Set-CASMailbox, to add a new ActiveSync allowed device, potentially gaining persistent access to a user's email and sensitive information.Attackers are increasingly targeting Exchange servers to gain access to sensitive email data. This activity involves the use of PowerShell to modify mailbox settings, specifically to add new ActiveSync allowed devices. The addition of rogue devices allows the attacker to maintain persistent access, bypassing typical authentication controls. This technique has been observed in intrusions following initial compromise via vulnerabilities like the SolarWinds supply chain attack. This can lead to long-term access to sensitive information, facilitating data exfiltration or further exploitation within the compromised organization. Defenders must monitor PowerShell activity related to Exchange management and validate any changes to ActiveSync configurations.

Attack Chain

1. Initial access is gained to a compromised host, potentially through exploitation of a vulnerability or stolen credentials.
2. The attacker uses PowerShell to interact with the Exchange Management Shell (EMS).
3. The Set-CASMailbox cmdlet is invoked with the ActiveSyncAllowedDeviceIDs parameter.
4. A new, unauthorized device ID is added to the list of allowed devices for a target mailbox.
5. The attacker uses the newly authorized device to synchronize with the target mailbox via the ActiveSync protocol.
6. Email data, including sensitive information, is accessed and potentially exfiltrated from the mailbox.
7. The attacker maintains persistent access to the mailbox through the authorized device, even if the user changes their password.

Impact

Successful execution of this attack allows adversaries to maintain persistent access to targeted mailboxes, enabling the collection of sensitive information. This can lead to financial losses, reputational damage, and exposure of confidential data. The number of victims can vary depending on the scope of the attacker's objectives. The technique has been observed in attacks targeting organizations across various sectors. If successful, attackers can exfiltrate sensitive data, compromise internal communications, and potentially gain further access to the organization's network.

Recommendation

• Monitor process execution for PowerShell commands containing Set-CASMailbox and ActiveSyncAllowedDeviceIDs to detect suspicious activity (see Sigma rule "Detect Suspicious ActiveSync Mailbox Modification via PowerShell").
• Enable Sysmon process creation logging with command line arguments to capture PowerShell activity (reference Sigma rule logsource).
• Review Exchange audit logs for modifications to ActiveSyncAllowedDeviceIDs attribute to identify unauthorized device additions.
• Implement multi-factor authentication (MFA) to mitigate the risk of credential compromise (reference: MITRE ATT&CK T1114).
• Regularly audit ActiveSync device configurations for unauthorized devices (reference: description).

]]>mediumthreatexchangepowershellactivesyncpersistence