We’ve detected suspicious activity in multiple environments today, and, while we haven’t yet observed a payload, we’re concerned the activity may be the result of Exchange Server compromise. 1/7 #RCintel 
What we’re observing is consistent with DLTminer precursor activity uncovered by @vmw_carbonblack in 2019, specifically its use of scheduled tasks to execute PowerShell and make external network connections. carbonblack.com/blog/cb-tau-te… 2/7
Prior to the Scheduled Task and PowerShell activity, we’re seeing the adversary leverage the IIS Worker process (w3wp.exe) to spawn the Command Processor in a manner that’s consistent with web shell activity. 3/7
This is noteworthy because we believe the adversary may be exploiting Exchange Server vulnerabilities. Luckily there are at least two detection opportunities here that should be useful for detecting certain web shells and post-exploitation activity. 4/7
Detection opportunity #1: Monitor for a chain of process executions from a Windows IIS worker process (`w3wp.exe`) that spawns a process that appears to be the command processor (`cmd`), which, in turn, launches PowerShell (`powershell.exe` or `pwsh.exe`) 5/7
Detection opportunity # 2: Look out for a process that appears to be `schtask.exe` executing in conjunction with a command line that includes the following parameters: `create` and `powershell` 6/7
These detections suggest an Exchange Server compromise, which is timely considering the Exchange vulnerabilities patched this week. This activity serves as a reminder to patch your Exchange servers ASAP and to practice defense in depth with broad behavioral analytics. 7/7
• • •
Missing some Tweet in this thread? You can try to
force a refresh
