Product
MSExchange
- First Reported
- Nov 28, 2023
- Latest Reported
- Feb 14, 2024
Reported Context (2)
- by Windows Defender also corresponded with event records from the C:\Windows\System32\winevt\Logs\MSExchange Management.evtx Event Log file, with source “MSExchange CmdletLogs“, and event ID 6. These event Huntress Correlates Exchange Logs and Defender Alerts to Investigate Exploit Activity
- data from the endpoint. In this particular case, the threat actor was able to create a webshell on an MSExchange server. This particular endpoint was not running Windows Defender, and was therefore not monitored via Attackers Used Windows Finger Utility to Exfiltrate Data from an Exchange Server
People (4)
MITRE ATT&CK (8)
Vendors (1)
Products (2)
Tools (5)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.