Question about Hafnium-related entry in IIS log file

Stefan Falk 166 Reputation points
2021-03-12T14:59:40.537+00:00

Hello everybody,

a german customer is running Exchange 2016 and installed CU19 and the Hafnium patch on 2021-03-04. Running the then current version of the Test-Hafnium.ps1 script, which the Exchange team put on GitHub, showed:

"DateTime","AnchorMailbox"
"2021-03-03T08:06:05.126Z","ServerInfo~a]@sn .customerdomain.de/autodiscover/autodiscover.xml?#"
"2021-03-03T11:33:18.593Z","ServerInfo~a]@sn .customerdomain.de/autodiscover/autodiscover.xml?#"
"2021-03-03T13:39:33.153Z","ServerInfo~a]@sn .customerdomain.de/autodiscover/autodiscover.xml?#"
"2021-03-03T13:39:36.546Z","ServerInfo~a]@sn .customerdomain.de/mapi/emsmdb/?#"
"2021-03-03T13:39:38.925Z","ServerInfo~a]@sn .customerdomain.de/ecp/proxyLogon.ecp?#"
"2021-03-03T13:39:42.650Z","ServerInfo~a]@sn .customerdomain.de/ecp/DDI/DDIService.svc/GetObject?msExchEcpCanary=-OlNq08-d06AaYApbaSPFtoynh_c39gIS35a8dhtli23cZk8G1r--7R0C8P_ce8LqCfENIZYkg0.&schema=OABVirtualDirectory#"

I would interpret this as the effort to use an eventually already installed Hafnium backdoor, but not as a sign of a successfull attack, neither for the installation of the backdoor nor to a successful exploitation. So there was someone who tried if that server had the backdoor installed, but I feel it was never installed. IIS logs were available down to early January 2021.

Would you agree or is this a sign that the server had been compromized?

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,335 questions
0 comments
Accepted answer
  1. Xzsssss 8,861 Reputation points Microsoft Vendor
    2021-03-15T05:40:43.553+00:00

    Hi @Stefan Falk ,

    As the Microsoft Doc explains:
    77589-image.png
    I think you may got the attack by CVE-2021-26855, as the security update patch has fixed this SSRF vulnerability, I think your Exchange server is safe now.

    But it is also suggested to double check the whole system with Safety Scanner(has been provided by Andy above), or apply the mitigation: ExchangeMitigations.ps1.

    Regards,
    Lou

    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Stefan Falk 166 Reputation points
    2021-03-15T11:11:45.633+00:00

    Hello Andy and Lou,

    Thank you for your valuable input. I wanted to accept both of your postings as answer, but one can only pick one.

    We had run all those tools and are confident that the server hasn't been hacked now. Thank you again.

    Best Regards,
    Stefan

    1 person found this answer helpful.
    0 comments
  2. Andy David - MVP 141.1K Reputation points MVP
    2021-03-12T16:03:32.25+00:00

    Scan for any known malware from these exploits:
    https://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021/
    https://learn.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

    If you do not find any , that's a pretty good sign that there is no compromise - but they should remain vigilant.
    Ensure you have a permanent anti-malware solution

    0 comments