Huntress Correlates Exchange Logs and Defender Alerts to Investigate Exploit Activity
Summary
Huntress analysts correlated Defender, PowerShell, Exchange, and web-server logs to investigate commands sent to an unpatched Exchange endpoint. The activity appeared consistent with a scan; Defender remediated the commands, and the customer was urged to update.
Key points
- A Huntress customer added its agent to an endpoint in January 2024; analysts then found a Defender alert for finger.exe activity linked to an IP associated with activity observed in November 2023.
- Windows Defender logs showed four commands, including three base64-encoded PowerShell commands; Defender reported remediating all four.
- Exchange CmdletLogs and web-server logs contained events corresponding in time to the detected commands, helping analysts corroborate the activity.
- The commands occurred within less than a minute. With no follow-on activity identified, Huntress assessed that they appeared to be associated with a scan.
- Huntress found the customer's Exchange installation had last been updated in September 2021 and notified the customer of the need to update.
- The article says prior identification and sharing of indicators helped Huntress investigate activity that predated installation of its agent.
Article Details
- Attack Vectors
- A legacy MSExchange exploit associated with the OWASSRF exploit information was used against an endpoint; Huntress assessed that the observed commands appeared to be associated with a scan because no follow-on activity was identified.
- Commands were issued through MSExchange PowerShell, including base64-encoded PowerShell and Windows Command Shell commands.
- The finger.exe utility was used to send reconnaissance information to an external IP address.
- Defensive Notes
- Update MSExchange installations; the affected customer's version had last been updated in September 2021.
- Correlate Windows Defender detection events, MSExchange CmdletLogs event ID 6, and web server POST logs to investigate activity.
- Windows Defender remediated all four detected commands, but the observed 17-second gap between detection and action was considered enough time for a command to complete.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 185[.]56[.]83[.]82 | IP address associated with the activity; source of POST requests to the web server and destination for finger.exe commands. |
MITRE ATT&CK
T1059.001 · PowerShellThree detected commands were base64-encoded PowerShell commands executed through MSExchange.T1059.003 · Windows Command ShellThe final detected command invoked cmd.exe to run finger.exe.T1078 · Valid AccountsUnit42's threat brief, as cited by the article, stated that the actor had to authenticate to the server before exploitation.T1190 · Exploit Public-Facing ApplicationThe observed activity was associated with exploitation of a public-facing MSExchange server.
People
Vendors
Products
MSExchangeby Windows Defender also corresponded with event records from the C:\Windows\System32\winevt\Logs\MSExchange Management.evtx Event Log file, with source “MSExchange CmdletLogs“, and event ID 6. These eventWindows Defenderand as soon as the agent began reporting in, Huntress SOC analyst Josh Allman noticed a legacy Windows Defender detection, what Huntress refers to as a “Managed Antivirus” (MAV) alert (illustrated in Figure 2)