Exchange Zero Day Vulnerabilities being exploited in the wild - CVE-2022-41040 & CVE-2022-41082

Thanks for sharing this.

No problem, mitigating the issue is simple.

Following ports can also be blocked:

• HTTP: 5985 
• HTTPS: 5986 

Thanks for sharing @dips! 

Since I do not wanted to create a new post on this topic, here is a blogpost of all that needs to be done until the patches are released: https://techdirectarchive.com/2022/10/01/cve-2022-41040-and-cve-2022-41082-workaround-for-a-zero-day-vulnerability-on-microsoft-exchange-server/

Microsoft have published an analysis here:

https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/

In Addition, if using Microsoft 365 Defender, there are some advanced hunting queries that can be utilised:

Suspicious files in Exchange Directories:

DeviceFileEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName == "w3wp.exe"
| where FolderPath has "FrontEnd\\HttpProxy\\"
| where InitiatingProcessCommandLine contains "MSExchange"
| project FileName,FolderPath,SHA256, InitiatingProcessCommandLine, DeviceId, Timestamp

Chopper Web Shell Activity: 

DeviceProcessEvents
| where InitiatingProcessFileName =~ "w3wp.exe"
| where ProcessCommandLine has_any ("&ipconfig&echo", "&quser&echo", "&whoami&echo", "&c:&echo", "&cd&echo", "&dir&echo", "&echo [E]", "&echo [S]")

Thanks for posting this here @dips I wanted to fo the same but didn't find time yesterday.

Blocking the ports isn't enough in this case. You would have to implement the redirect/blocking rule in order to prevent any attacks. The good news is that Microsoft has pushed a mitigation via the Emergency Mitigation Service yesterday:

https://techcommunity.microsoft.com/t5/exchange-team-blog/customer-guidance-for-reported-zero-day-vulnerabilities-in/ba-p/3641494

No problem @regnor 

Thanks for the link. Looks like Microsoft will probably end up changing their guidance a few more times until they work out the final details but glad they have pushed a mitigation out in the meanwhile. 

I agree with you on this because, those are just the WinRM config transport port for HTTP/HTTPS. The only temporary fix is the workaround suggested by the security researchers to have the redirect blocking rule implemented.

In my guide, I included rules to see if you have been compromised!

Exactly! This continue to change, and the change will be transparent as the mrsc-blog post will be updated with new information.