[Issue]What does the output from this script mean? about css-exchange HOT 9 CLOSED

Please refer to https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

The script is only designed to call out what the article tells you to look for IOCs, with better performance than what is provided in the article.

Based off the output, besides the zips if you expect those, it is providing that you do have indicators that you were compromised based off the http proxy logs output.

from css-exchange.

I also get tons of suspicious files. There is no way to even remotely know if those are valid or not.
MS, please patch my Exchange 2010 server.

from css-exchange.

Any zip files will be flagged as suspicious, as noted in the blog post:

 Check for suspicious .zip, .rar, and .7z files in C:\ProgramData\, which may indicate possible data exfiltration.

It's up to the admin to determine whether those zip files are something expected due to related software being installed, or something unexpected.

The ServerInfo~ output is a sign of CVE-2021-26855, as noted in the same blog post.

from css-exchange.

Any zip files will be flagged as suspicious, as noted in the blog post:

 Check for suspicious .zip, .rar, and .7z files in C:\ProgramData\, which may indicate possible data exfiltration.

It's up to the admin to determine whether those zip files are something expected due to related software being installed, or something unexpected.

The ServerInfo~ output is a sign of CVE-2021-26855, as noted in the same blog post.

The zipfiles are expected. How do I figure out what exactly was done via the HTTP proxy and what exactly am I supposed to do now? I installed the patches an hour after you released them. It sounds like everybody that runs exchange on prem was impacted.

from css-exchange.

Sorry, we cannot give that kind of guidance here. This repo is for fixing bugs in the scripts. Please refer to our blogs or open a support case for help.

from css-exchange.

from css-exchange.

The point is to run the commands from the blog post. If you find no value in it, there is no need to use it.

from css-exchange.

from css-exchange.

As you seem to have no further technical questions related to this repo, I guess we can close this now.

from css-exchange.