In many cases, after attackers gain access to an Exchange server, what follows is the deployment of web shell into one of the many web accessible paths on the server. As we discussed in a previous blog, web shells<\/a> allow attackers to steal data or perform malicious actions for further compromise.<\/p>\n Adversaries like using web shells, which are relatively small pieces of malicious code written in common programming languages, because these can be easily modified to evade traditional file-based protections. A more durable approach to detecting web shell activity involves profiling process activities originating from external-facing Exchange applications.<\/p>\n Behavior-based blocking and containment<\/a> capabilities in Microsoft Defender ATP, which use engines that specialize in detecting threats by analyzing behavior<\/a>, surface suspicious and malicious activities on Exchange servers. These detection engines are powered by cloud-based machine learning classifiers that are trained by expert-driven profiling of legitimate vs. suspicious activities in Exchange servers.<\/p>\n In April, multiple Exchange-specific behavior-based detections picked up unusual activity. The telemetry showed attackers operating on on-premises Exchange servers using deployed web shells. Whenever attackers interacted with the web shell, the hijacked application pool ran the command on behalf of the attacker, generating an interesting process chain. Common services, for example Outlook on the web (formerly known as Outlook Web App or OWA) or Exchange admin center (EAC; formerly known as the Exchange Control Panel or ECP), executing net.exe<\/em>, cmd.exe<\/em>, and other known living-off-the-land binaries (LOLBins<\/a>) like mshta.exe<\/em> is very suspicious and should be further investigated.<\/p>\n Figure 1. Behavior-based detections of attacker activity on Exchange servers<\/em><\/p>\n In this blog, we\u2019ll share our investigation of the Exchange attacks in early April, covering multiple campaigns occurring at the same time. The data and techniques from this analysis make up an anatomy of Exchange server attacks. Notably, the attacks used multiple fileless techniques, adding another layer of complexity to detecting and resolving these threats, and demonstrating how behavior-based detections are key to protecting organizations.<\/p>\n Figure 2. Anatomy of an Exchange server attack<\/em><\/p>\n Attackers started interacting with target Exchange servers through web shells they had deployed. Any path accessible over the internet is a potential target for web shell deployment, but in these attacks, the most common client access paths were:<\/p>\n The ClientAccess and FrontEnd directories provide various client access services such as Outlook on the web, EAC, and AutoDiscover, to name a few. These IIS virtual directories are automatically configured during server installation and provide authentication and proxy services for internal and external client connections.<\/p>\n These directories should be monitored for any new file creation. While file creation events alone cannot be treated as suspicious, correlating such events with the responsible process results in more reliable signals. Common services like OWA or ECP dropping .aspx<\/em> or .ashx<\/em> files in any of the said directories is highly suspicious.<\/p>\n In our investigation, most of these attacks used the China Chopper<\/a> web shell. The attackers tried to blend the web shell script file with other .aspx<\/em> files present on the system by using common file names. In many cases, hijacked servers used the \u2018echo\u2019 command to write the web shell. In other cases, certutil.exe<\/em> or powershell.exe<\/em> were used. Here are some examples of the China Chopper codes that were dropped in these attacks:<\/p>\n We also observed the attackers switching web shells or introducing two or more for various purposes. In one case, the attackers created an .ashx<\/em> version of a popular, publicly available .aspx<\/em> web shell, which exposes minimum functionality:<\/p>\n Figure 3. Microsoft Defender ATP alert for web shell<\/em><\/p>\n After web shell deployment, attackers typically ran an initial set of exploratory commands like whoami<\/em>, ping<\/em>, and net user<\/em>. In most cases, the hijacked application pool services were running with system privileges, giving attackers the highest privilege.<\/p>\n Attackers enumerated all local groups and members on the domain to identify targets. Interestingly, in some campaigns, attackers used open-source user group enumerating tools like lg.exe<\/em> instead of the built-in net.exe<\/em>. Attackers also used the EternalBlue<\/a> exploit and nbtstat<\/em> scanner to identify vulnerable machines on the network.<\/p>\n Next, the attackers ran built-in Exchange Management Shell cmdlets to gain more information about the exchange environment. Attackers used these cmdlets to perform the following:<\/p>\n Figure 4. Microsoft Defender ATP alert showing process tree for anomalous account lookups<\/em><\/p>\n On misconfigured servers where they have gained the highest privileges, attackers were able to add a new user account on the server. This gave the attackers the ability to access the server without the need to deploy any remote access tools.<\/p>\n The attackers then added the newly created account to high-privilege groups like Administrators, Remote Desktop Users, and Enterprise Admins, practically making the attackers a domain admin with unrestricted access to any users or group in the organization.<\/p>\n Figure 5. Microsoft Defender ATP alert showing process tree for addition of local admin using Net commands<\/em><\/p>\n Exchange servers contain the most sensitive users and groups in an organization. Gaining credentials to these accounts could virtually give attackers domain admin privileges.<\/p>\n In our investigation, the attackers first dumped user hashes by saving the Security Account Manager (SAM) database from the registry.<\/p>\n Next, the attackers used the ProcDump tool to dump the Local Security Authority Subsystem Service (LSASS) memory. The dumps were later archived and uploaded to a remote location.<\/p>\n In some campaigns, attackers dropped Mimikatz and tried to dump hashes from the server.<\/p>\n Figure 6. Microsoft Defender ATP alert on detection of Mimikatz<\/em><\/p>\n In environments where Mimiktaz was blocked, attackers dropped a modified version with hardcoded implementation to avoid detection. Attackers also added a wrapper written in the Go programming language to make the binary more than 5 MB. The binary used the open-source MemoryModule library to load the binary using reflective DLL injection<\/a>. Thus, the payload never touched the disk and was present only in memory, achieving a fileless persistence.<\/p>\n The attackers also enabled \u2018wdigest<\/em>\u2019 registry settings, which forced the system to use WDigest protocol for authentication, resulting in lsass.exe<\/em> retaining a copy of the user\u2019s plaintext password in memory. This change allowed the attacker to steal the actual password, not just the hash.<\/p>\n Another example of stealthy execution that attackers implemented was creating a wrapper binary for ProcDump and Mimikatz. When run, the tool dropped and executed the ProcDump binary to dump the LSASS memory. The memory dump was loaded inside the same binary and parsed to extract passwords, another example of reflective DLL injection<\/a> where the Mimikatz binary was present only in memory.<\/p>\n With attacker-controlled accounts now part of Domain Admins group, the attackers performed a technique called DCSYNC<\/a> attack, which abuses the Active Directory replication capability to request account information, such as the NTLM hashes of all the users\u2019 passwords in the organization. This technique is extremely stealthy because it can be performed without running a single command on the actual domain controller.<\/p>\n In these attacks, the attackers used several known methods to move laterally:<\/p>\n The Exchange Management Shell is the PowerShell interface for administrators to manage the Exchange server. As such, it exposes many critical Exchange PowerShell cmdlets to allow admins to perform various maintenance tasks, such as assigning roles and permissions, and migration, including importing and exporting mailboxes. These cmdlets are available only on Exchange servers in the Exchange Management Shell or through remote PowerShell connections to the Exchange server.<\/p>\n To understand suspicious invocation of the Exchange Management Shell, we need to go one step back in the process chain and analyze the responsible process. As mentioned, common application pools MSExchangeOWAAppPool<\/em> or MSExchangeECPAppPool<\/em> accessing the shell should be considered suspicious.<\/p>\n In our investigation, attackers leveraged these admin cmdlets to perform critical tasks such as exporting mailboxes or running arbitrary scripts. Attackers used different ways to load and run PowerShell cmdlets through the Exchange Management Shell.<\/p>\n In certain cases, attackers created a PowerShell wrapper around the commands to effectively hide behind legitimate PowerShell activity.<\/p>\n These cmdlets allowed the attackers to perform the following:<\/p>\n In our investigations, attackers were primarily interested in received emails. They searched for message delivery information filtered by the event \u2018Received\u2019. The search time frame showed the attackers were initially interested in the entire log history. Later, a similar command was run with a trimmed timeline of one year.<\/p>\n Attackers exported mailboxes through these four steps:<\/p>\n As part of lateral movement, the attackers attempted to disable Microsoft Defender Antivirus. Attackers also disabled archive scanning to bypass detection of tools and data compressed in .zip files, as well as created exclusion for .dat<\/em> extension. The attackers tried to disable automatic updates to avoid any detection by new intelligence updates. For Microsoft Defender ATP customers, tamper protection<\/a> prevents such malicious and unauthorized changes to security settings.<\/p>\n The next step for attackers was to create a network architecture using port forwarding tools like plink.exe<\/em>, a command line connection tool like ssh<\/em>. Using these tools allowed attackers to bypass network restrictions and remotely access machines through Remote Desktop Protocol (RDP). This is a very stealthy technique: attackers reused dumped credentials to access the machines through encrypted tunneling software, eliminating the need to deploy backdoors, which may have a high chance of getting detected.<\/p>\n Finally, dumped data was compressed using the utility tool rar.exe.<\/em> The compressed data mostly comprised of the extracted .pst<\/em> files, along with memory dumps.<\/p>\n As these attacks show, Exchange servers are high-value targets. These attacks also tend to be advanced threats with highly evasive, fileless techniques. For example, at every stage in the attack chain above, the attackers abused existing tools (LOLBins) and scripts to accomplish various tasks. Even in cases where non-system binaries were introduced, they were either legitimate and signed, like plink.exe<\/em>, or just a proxy for the malicious binary, for example, the modified Mimikatz where the actual malicious payload never touched the disk.<\/p>\n Keeping these servers safe from these advanced attacks is of utmost importance. Here are steps that organizations can take to ensure they don\u2019t fall victim to Exchange server compromise.<\/p>\n Identify and remediate vulnerabilities or misconfigurations in Exchange servers. Deploy the latest security updates, especially for server components like Exchange, as soon as they become available. Specifically, check that the patches for CVE-2020-0688 is in place. Use threat and vulnerability management<\/a> to audit these servers regularly for vulnerabilities, misconfigurations, and suspicious activity.<\/p>\n It\u2019s critical to protect Exchange servers with antivirus software<\/a> and other security solutions like firewall protection and MFA. Turn on cloud-delivered protection<\/a> and automatic sample submission to use artificial intelligence and machine learning to quickly identify and stop new and unknown threats. Use attack surface reduction rules<\/a> to automatically block behaviors like credential theft and suspicious use of PsExec and WMI. Turn on tamper protection<\/a> features to prevent attackers from stopping security services.<\/p>\n If you are worried that these security controls will affect performance or disrupt operations, engage with IT pros to help determine the true impact of these settings. Security teams and IT pros should collaborate on applying mitigations and appropriate settings<\/a>.<\/p>\n Review highly privileged groups like Administrators, Remote Desktop Users, and Enterprise Admins. Attackers add accounts to these groups to gain foothold on a server. Regularly review these groups for suspicious additions or removal. To identify Exchange-specific anomalies, review the list of users in sensitive roles such as mailbox import export<\/em> and Organization Management<\/em> using the Get-ManagementRoleAssignment<\/em> cmdlet in Exchange PowerShell.<\/p>\n Practice the principle of least-privilege and maintain credential hygiene. Avoid the use of domain-wide, admin-level service accounts. Enforce strong randomized, just-in-time local administrator passwords<\/a> and Enable MFA. Use tools like LAPS<\/a>.<\/p>\n Place access control list (ACL) restrictions on ECP and other virtual directories in IIS. Don\u2019t expose the ECP directory to the web if it isn\u2019t necessary and to anyone in the company who doesn\u2019t need to access it. Apply similar restrictions to other application pools.<\/p>\n Pay attention to and immediately investigate alerts indicating suspicious activities on Exchange servers. Catching attacks in the exploratory phase, the period in which attackers spend several days exploring the environment after gaining access, is key. Common application pools like \u2018MSExchangeOWAAppPool\u2019<\/em> or \u2018MSExchangeECPAppPool\u2019<\/em> are commonly hijacked by attackers through web shell deployment. Prioritize alerts related to processes such as net.exe<\/em>, cmd.exe<\/em>, and mshta.exe<\/em> originating from these pools or w3wp.exe<\/em> in general.<\/p>\n Behavior-based blocking and containment capabilities in Microsoft Defender Advanced Threat Protection<\/a> stop many of the malicious activities we described in this blog. Behavior-based blocking and containment stops advanced attacks in their tracks by detecting and halting malicious processes and behaviors.<\/p>\n Figure 7. Microsoft Defender ATP alerts on blocked behaviors<\/em><\/p>\n In addition, Microsoft Defender ATP\u2019s endpoint detection and response (EDR) sensors provide visibility into other suspicious and malicious activities on Exchange servers, which are raised as alerts. The new alert page presents data in an investigation-driven approach meant to empower SecOps teams to easily investigate and take actions.<\/p>\n Figure 8. Microsoft Defender ATP alert and process tree<\/em><\/p>\n If these alerts are immediately prioritized, security operations teams can better mitigate attacks and prevent further damage. Beyond resolving these alerts in the shortest possible time, however, organizations should focus on investigating the end-to-end attack chain and trace the vulnerability, misconfiguration, or other weakness in the infrastructure that allowed the attack to occur.<\/p>\n Microsoft Defender ATP is a component of the broader Microsoft Threat Protection<\/a> (MTP), which provides comprehensive visibility into advanced attacks by combining the capabilities of Office 365 ATP, Azure ATP, Microsoft Cloud App Security, and Microsoft Defender ATP. Through the incidents<\/a> view, MTP provides a consolidated picture of related attack evidence that shows the complete attack story, empowering SecOps teams to thoroughly investigate attacks.<\/p>\n In addition, MTP\u2019s visibility into malicious artifacts and behavior empowers security operations teams to proactively hunt for threats on Exchange servers. For example, MTP can be connected to Azure Sentinel to enable web shell threat hunting<\/a>.<\/p>\n Through built-in intelligence and automation, Microsoft Threat Protection coordinates protection, detection, and response across endpoints, identity, data, and apps. Learn more<\/a>.<\/p>\nBehavior-based detection and blocking of malicious activities on Exchange servers<\/h2>\n
![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/suspicious-behaviors-detected-on-exchange-servers.png\")
<\/p>\n![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/Exchange-servers-attack-chain-2.png\")
<\/a><\/p>\nInitial access: Web shell deployment<\/h2>\n
\n
![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/a-Exchange-server-web-shell-1.png\")
<\/p>\n![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/b-Exchange-server-web-shell-2.png\")
<\/p>\n![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/A-suspicious-web-script-was-created.png\")
<\/a><\/p>\nReconnaissance<\/h2>\n
![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/c-Exchange-server-reconnaissance-1.png\")
<\/p>\n\n
![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/d-Exchange-server-reconnaissance-2.png\")
<\/p>\n![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/Anomalous-account-lookups.png\")
<\/a><\/p>\nPersistence<\/h2>\n
![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/e-Exchange-server-persistence.png\")
<\/p>\n![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/New-local-admin-added-using-Net-commands.png\")
<\/a><\/p>\nCredential access<\/h2>\n
![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/f-Exchange-server-credential-access-1.png\")
<\/p>\n![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/g-Exchange-server-credential-access-2.png\")
<\/p>\n![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/h-Exchange-server-credential-access-3.png\")
<\/p>\n![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/Malicious-credential-theft-tool-execution-detected.png\")
<\/a><\/p>\n![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/i-Exchange-server-credential-access-4.png\")
<\/p>\n![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/j-Exchange-server-credential-access-5.png\")
<\/p>\n![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/k-Exchange-server-credential-access-6.png\")
<\/p>\n![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/l-Exchange-server-credential-access-7.png\")
<\/p>\nLateral movement<\/h2>\n
\n
![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/m-Exchange-server-lateral-movement-1.png\")
<\/p>\n\n
![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/n-Exchange-server-lateral-movement-2.png\")
<\/p>\n![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/o-Exchange-server-lateral-movement-3.png\")
<\/p>\n\n
![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/p-Exchange-server-lateral-movement-4.png\")
<\/p>\nExchange Management Shell abuse<\/h2>\n
![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/q-Exchange-server-abuse-ems-1.png\")
<\/p>\n![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/r-Exchange-server-abuse-ems-2.png\")
<\/p>\n\n
![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/s-Exchange-server-abuse-ems-3.png\")
<\/p>\n\n
\n
\n
![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/t-Exchange-server-abuse-ems-4.png\")
<\/p>\n![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/u-Exchange-server-abuse-ems-5.png\")
<\/p>\nTampering with security tools<\/h2>\n
![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/v-Exchange-server-security-tampering.png\")
<\/p>\nRemote access<\/h2>\n
![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/w-Exchange-server-remote-access.png\")
<\/p>\nExfiltration<\/h2>\n
![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/x-Exchange-server-exfiltration.png\")
<\/p>\n\n
\n
\n
\n
\n
![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/IISExchgSpawnCMD-1-1.png\")
![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/IISExchgSpawnEMS-1.png\")
<\/p>\n![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/WebShellTerminal-1.png\")
![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/IISExchgSpawnNET-1.png\")
<\/p>\n![](\"https:\/\/www.microsoft.com\/security\/blog\/wp-content\/uploads\/2020\/06\/Possible-IIS-web-shell.png\")
<\/a><\/p>\n