HAFNIUM question

Matt Pollock 246 Reputation points
2021-03-09T10:34:43.243+00:00

Hi,

as per the advice give in the article:

https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

I have run the powershell command to identify any logfile entries on each of my exchange servers.

A couple of hits have been returned, but I cannot find the entries in the corresponding autodiscover log files on any servers.

Eg.

DateTime AnchorMailbox

2021-03-03T07:10:58.123Z ServerInfo~a]@servername.domain.local:444/autodiscover/autodiscover.xml?#

I've looked at the logs for the corresponding timeframe in the following locations, on all servers:

%PROGRAMFILES%\Microsoft\Exchange Server\V15\Logging\Autodiscover
%PROGRAMFILES%\Microsoft\Exchange Server\V15\Logging\HttpProxy\Autodiscover

Am I looking in the wrong place for these log files?

Thanks

Microsoft Exchange Online Management
Microsoft Exchange Online Management
Microsoft Exchange Online: A Microsoft email and calendaring hosted service.Management: The act or process of organizing, handling, directing or controlling something.
4,199 questions
Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,360 questions
0 comments
Accepted answer
  1. Andy David - MVP 142.3K Reputation points MVP
    2021-03-10T12:10:27.383+00:00

    If you aren't finding anything in the scans, its a pretty good indicator that you arent compromised. The MSERT tools looks for known malware and exploits from all those exploits - not a particular one.

    Make sure you are patched and have an existing anti-malware product running on the Exchange Servers for the future.

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andy David - MVP 142.3K Reputation points MVP
    2021-03-09T12:01:35.197+00:00

    2021-03-03T07:10:58.123Z ServerInfo~a]@servername.domain.local:444/autodiscover/autodiscover.xml?#

    These would be in the IIS logs

    I would also scan your system

    https://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021/

    Microsoft Support Emergency Response Tool (MSERT) to scan Microsoft Exchange Server

  2. Yuki Sun-MSFT 40,871 Reputation points
    2021-03-10T04:40:45.743+00:00

    Hi @Matt Pollock ,

    Aside from the HttpProxy\Autodiscover folder, you can also look at the other subfolders under %PROGRAMFILES%\Microsoft\Exchange Server\V15\Logging\HttpProxy for the entries.

    I've just seen the thread below which mentioned that similar entries are found in the HttpProxy ECP logfiles:
    HAFNIUM Attack

    Furthermore, as mentioned by Kael in the thread above, if the logs only show references to autodiscover.xml and you didn't see any other suspicious activity like ECP/OWA/OAB or evidence of the other CVE's being hit, it's recommended to prioritize applying the security updates to your Exchange Servers and keep monitoring.

    If an Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.