Hello,
I am new to Powershell and based on the recent news regarding the Hafnium attack the TestProxyLogonScript was provided to check exchange servers for potential infiltration. Being new to PowerShell, I want to be sure that there is nothing in the script that is meant to change data. Particularly as the disclaimer in the script states is it provided as is without warranty of any kind.
As you can imagine, I don't want to use my exchange server as a test environment. How can I test that script before running it live? Has anyone already run the script and if so, were there any issues?
I have already installed the recommendation patch KB5000871.
In the https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/#scan-log
Regarding the following I don't see any entries with a pattern of "ServerInfo~/
CVE-2021-26855 exploitation can be detected via the following ExchangeHttpProxy logs:
These logs are located in the following directory:%PROGRAMFILES%\Microsoft\ExchangeServer\V15\Logging\HttpProxy
3/6/2021 HAFNIUM targeting Exchange Servers with 0-day exploits - Microsoft Security
https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/#scan-log 7/17
Exploitation can be identified by searching for log entries where theAuthenticatedUser is empty and the AnchorMailbox contains thepattern of ServerInfo~/
CVE-2021-26858 exploitation can be detected via the Exchange log files:
C:\Program Files\Microsoft\ExchangeServer\V15\Logging\OABGeneratorLog - I don't see files other than the logs here
Files should only be downloaded to the%PROGRAMFILES%\Microsoft\ExchangeServer\V15\ClientAccess\OAB\Temp directory- This folder is empty
Regarding the following I checked the Event Viewer and do not see any events like this.
CVE-2021-26857 exploitation can be detected via the Windows Application event logs
Exploitation of this deserialization bug will create Application events with the following properties:
Source: MSExchange Unified Messaging
EntryType: Error
Event Message Contains: System.InvalidCastException
Regarding the following I don't see any non-internal or External URLs
CVE-2021-27065 exploitation can be detected via the following Exchange log files:
C:\Program Files\Microsoft\Exchange Server\V15\Logging\ECP\Server
All Set-<AppName>VirtualDirectory properties should never contain script. InternalUrl and ExternalUrl should only be valid Uris.
I also see the reference to run the Microsoft Safety Scanner at https://github.com/microsoft/CSS-Exchange/blob/main/Security/Defender-MSERT-Guidance.md. I did run this on the exchange server and it stated no vulnerabilities were found. Does this mean my exchange environment was not compromised?
Thanks,
Roger
