OK - I ran Test-ProxyLogon.ps1 for the zero day attack

Question

I patched and shut down my server before this scan was available. My server is isolated to the internet but I brought it up long enough to run the scan.

The response log is just a bunch of IP addresses.

or

or

Anyone know what to do with this info?

Answer 1

that script checks to see if there are any indications of the exploit. it doesnt mean you have been exploited however.
If you already removed any malware and dealt with the it, then you should be good. Just continue to be vigilant :)

Answer 2

Scan to see if there are any exploits. It not, then you are good.

https://msrc-blog.microsoft.com/2021/03/16/guidance-for-responders-investigating-and-remediating-on-premises-exchange-server-vulnerabilities/

Exchange On-premises Mitigation Tool
Download and run EOMT.ps1 as an administrator on your Exchange Server to automatically run the latest version of Microsoft Safety Scanner (MSERT). MSERT discovers and remediates web shells, which are backdoors that adversaries use to maintain persistence on your server.

https://github.com/microsoft/CSS-Exchange/tree/main/Security

Answer 3

Sorry - if I just ran that Test-ProxyLogon.ps1 - and got some results that I couldn't understand, what was the purpose of it? I'm not trying to be flip - I honestly don't know what the point of it was.

I'm not trying to patch my server - I've already gotten rid of it. I'm trying to ascertain if anything was really done.