HAFNIUM and aspx files

John Olivella 1 Reputation point

Hi All,

We have run scanner on both of our exchange 2016 servers and one came back positive and the other negative.

However, on both servers, these files are .aspx files in %PROGRAMFILES%\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth:


Are these file normal in exchange 2016?
Also these files were created way before the attack.

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
6,512 questions
{count} votes

5 answers

Sort by: Most helpful
  1. Bill Nelson 1 Reputation point

    I have these same files on my server and I have the same question.

    0 comments No comments

  2. Ben Langers 1 Reputation point

    I have got those same files on an Exchange 2019 machine.
    There is one extra: getidtoken.htm
    Looks a bit out of place, there...
    Will run a restore of a version before this exploit to verify and post back...

    0 comments No comments

  3. Joyce Shen - MSFT 16,416 Reputation points Microsoft Vendor

    Hi @John Olivella

    I have checked in my environment, and found the same files under the path.

    These files should be nomal files for Exchange. For security reasons, I would suggest you use the MSERT.exe tool to scan your server.

    For more information: Microsoft Exchange Server Vulnerabilities Mitigations – updated March 9, 2021 ,mainly refer to the part Microsoft Support Emergency Response Tool (MSERT) to scan Microsoft Exchange Server.

    If an Answer is helpful, please click "Accept Answer" and upvote it.

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments No comments

  4. Ben Langers 1 Reputation point

    I can confirm I have the exact same files with the same creation dates and sizes on a restore of that box from before the exploit. Seems legit...

    0 comments No comments

  5. Goran 1 Reputation point

    The files you pointed out exist on my exchange also however I also had a recent incident where Backdoor shell script was installed in the ecp\auth virtual directory that looked like this:


    Here are some useful links that helped me narrow down the issue and remove them:


    0 comments No comments