Mass exploitation of on-prem Exchange servers :(

• ExchangeMarch2021IOCHunt

  1 19 0.0 PowerShell

  Really fast knock up use at own risk etc.

• Automate-Powershell

  1 0 0.0 PowerShell

Automate-Powershell/Hafniummonitor.ps1 at main · Data-Dan-sharing/Automate-Powershell (github.com)

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

• HealthChecker

  20 315 8.8 PowerShell

  Discontinued Exchange Server Performance Health Checker Script

Does it? Mine does not show there and I ran it from the .msp file. The health check script shows that it is detected though...

• Mitigating-Web-Shells

  2 943 0.0 YARA

  Guidance for mitigation web shells. #nsacyber

  

There is likely a Cobalt Strike BEACON acting as C2 now even if you've patched. I recommend full incident response mode, probably want to isolate the server. Run an integrity check against a known good config with WinDiff or NSA's dirChecker to find other anomolies. https://github.com/nsacyber/Mitigating-Web-Shells

Suggest a related project