Automatically mitigate ProxyLogon, detect IoCs associated with SolarWinds attackers' activities
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-26855 | Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon) CVE-2021-26855 is a server-side request forgery flaw (CWE-918) in Microsoft Exchange Server that allows an unauthenticated remote attacker to send specially crafted HTTP requests and have the Exchange server process them as itself, disclosing sensitive session information. When chained with sibling Exchange flaws (the 'ProxyLogon' chain), it yields authentication bypass and arbitrary file write, escalating to full remote code execution with SYSTEM-level privileges on the on-premises Exchange server. Any organization running an affected on-premises Exchange server reachable over HTTP/HTTPS (typically outbound webmail) is exposed; Exchange Online was not affected. Exploitation is confirmed in the wild at large scale: the flaw was mass-exploited beginning in early 2021 (notably by the HAFNIUM group), is on the CISA KEV with documented ransomware use, and has a maximum EPSS score of 100% (100th percentile), despite no public PoC listing. Do: Apply the vendor's March 2021 Exchange security updates (or later cumulative updates) immediately, per the CISA required action; until patched, limit Exchange (ECP/OWA) exposure to the internet via firewall/VPN rules. Hunt for compromise: review IIS logs for unrecognized authenticated activity against FrontEnd HttpProxy endpoints, and check for malicious files or webshells under inetpub\wwwroot\aspnet_client, given the known ransomware use. | 9.1 group max | 100% | KEV ransomware PoC ×4 |
| masshundreds of thousands of on-premises deployments; tens of thousands of internet-exposed Exchange servers |
Full article478 words · extracted from helpnetsecurity.com · click to collapse
Microsoft has updated its Defender Antivirus to mitigate the ProxyLogon flaw on vulnerable Exchange Servers automatically, while the Cybersecurity and Infrastructure Security Agency (CISA) has released CHIRP, a forensic tool that can help defenders find IoCs associated with the SolarWinds attackers’ activities.
“Similar to the CISA-developed Sparrow tool—which scans for signs of APT compromise within an M365 or Azure environment—CHIRP scans for signs of APT compromise within an on-premises environment,” the agency noted.
Automatically mitigate ProxyLogon
Microsoft is determined to do everything in its power to make sure that as many Exchange Servers as possible are made safe from exploits that start with the exploitation of ProxyLogon, the vulnerability recently leveraged by attackers to breach on-premises Microsoft Exchange Servers around the world.
“With the latest security intelligence update, Microsoft Defender Antivirus and System Center Endpoint Protection will automatically mitigate CVE-2021-26855 on any vulnerable Exchange Server on which it is deployed. Customers do not need to take action beyond ensuring they have installed the latest security intelligence update (build 1.333.747.0 or newer), if they do not already have automatic updates turned on,” the Microsoft 365 Defender Team explained.
Kevin Beaumont, a senior threat intelligence analyst at Microsoft, praised its effectiveness:
If anybody wants an idea as to how extraordinarily effective this is – I’ve been on holiday from work for two days, and MS automatically patched my personal honeypots via this 😂🙌🏾 no exploitation since.
Incredible engineering work.
— Kevin Beaumont (@GossiTheDog) March 19, 2021
For those who don’t have Microsoft Defender Antivirus, Microsoft advises using the recently released One-Click Microsoft Exchange On-Premises Mitigation Tool.
But, the company notes, both the updates and the one-click tool only mitigate CVE-2021-26855, not the rest of the vulnerabilities (CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065) exploited in the escalating attacks on Exchange servers, so “customers should still prioritize getting current on security updates for Exchange Server to comprehensively address the vulnerabilities.”
Detect IoCs associated with SolarWinds attackers’ activities
CHIRP – i.e., CISA Hunt and Incident Response Program – is offered in a form of a compiled executable or a Python script, and currently only works on machines running Windows operating systems, where it looks for:
- The Teardrop backdoor and the Raindrop loader (leveraged by the SolarWinds attackers)
- Credential dumping certificate pulls
- Persistence mechanisms identified as associated with the SolarWinds attackers’ efforts
- System, network, and M365 enumeration
- Known observable indicators of lateral movement
The tool is meant to be run manually. It provides results in a JSON format, which can be perused via a SIEM system, web browser, or text editor. It does not make any changes on the underlying system.
“Network defenders can follow step-by-step instructions on the CISA CHIRP GitHub repository to add additional IOCs, YARA rules, or plugins to CHIRP to search for post-compromise threat activity related to the SolarWinds Orion supply chain compromise or new threat activity,” CISA added.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2021/03/19/iocs-solarwinds-attackers/