Microsoft reports increased attacks on Exchange servers

• Microsoft Defender ATP Research Team released a guide on how to defend Exchange servers against malicious attacks using behavior-based detection.
• The ATP team is worried about attacks that exploit Exchange vulnerabilities like CVE-2020-0688. 
• You should start by reading more information on Exchange from our Microsoft Exchange section.
• If you're interested in more news about security, feel free to visit our Security Hub.

 

Microsoft Defender ATP Research Team released a guide on how to defend Exchange servers against malicious attacks using behavior-based detection.

There are two ways to scenarios of Exchange servers being attacked. The most common implies launching social engineering or drive-by download attacks targeting endpoints.

The ATP team is worried, however about the second type, attacks that exploit Exchange vulnerabilities like CVE-2020-0688. There was even an NSA warning about this vulnerability.

Microsoft already issued the security update to fix the vulnerability since February, but attackers still find servers that were not patched and hence, remained vulnerable.

How do I defend against attacks on Exchage servers?

Behavior-based blocking and containment capabilities in Microsoft Defender ATP, which use engines that specialize in detecting threats by analyzing behavior, surface suspicious and malicious activities on Exchange servers.

These detection engines are powered by cloud-based machine learning classifiers that are trained by expert-driven profiling of legitimate vs. suspicious activities in Exchange servers.

The Microsoft researchers studied Exchange attacks investigated during April, using multiple Exchange-specific behavior-based detections.

How do the attacks take place?

Microsoft also revealed the attack chain that the wrongdoers are using to compromise the Exchange servers.

It seems that attackers are operating on on-premises Exchange servers using deployed web shells. Whenever attackers interacted with the web shell, the hijacked application pool ran the command on behalf of the attacker.

This is an attacker’s dream: directly landing on a server and, if the server has misconfigured access levels, gain system privileges.

Microsoft also specified in the guide that the attacks used multiple fileless techniques, with added layers of complexity in detecting and solving the threats.

The attacks also demonstrated that behavior-based detections are key to protecting organizations.

For now, it appears that installing the patch is the only available remedy for the CVE-2020-0688 server vulnerability.

and

If you are looking for a cheap and genuine microsoft product key, warranty for 1 year.
It will be available at the link: https://officerambo.com/shop/
Microsoft Windows Embedded 8.1 Industry Pro : https://officerambo.com/product/windows-embedded-8-1/
Key Windows 7 Professional / Home Base / Home Premium (2 USER) : https://officerambo.com/product/key-windows-7/
Microsoft Windows 8.1 PRO (2 PC) : https://officerambo.com/product/microsoft-windows-8-1-pro/
Windows Server 2012 R2 : https://officerambo.com/product/windows-server-2012-r2/
Visual Studio Enterprise 2019 : https://officerambo.com/product/visual-studio-enterprise-2019/
Windows Server Standard / Datacenter / Essentials : https://officerambo.com/product/windows-server-all-version-standard-datacenter-essentials/
Microsoft Office Professional Plus for Windows : https://officerambo.com/product/microsoft-office-professional-plus-for-windows/
Microsoft Office Home and Student for Windows : https://officerambo.com/product/microsoft-office-home-and-student/
Key Microsoft Access 2016 : https://officerambo.com/product/key-microsoft-access-2016/
Microsoft Visio Professional : https://officerambo.com/product/microsoft-visio-professional/
Microsoft Project Professional : https://officerambo.com/product/microsoft-project-professional/
Account Microsoft Office 365 Profestional Plus 2020 Update For 5 Devices : https://officerambo.com/product/account-microsoft-office-365/
Key Microsoft Windows 10 Profestional / Profestional N : https://officerambo.com/product/key-microsoft-windows-10/
Key Microsoft Windows XP Pro : https://officerambo.com/product/key-microsoft-windows-xp-pro/
Microsoft Office Home and Business for Mac : https://officerambo.com/product/microsoft-office-home-and-business-for-mac/