Update 11/8/2022: We have now released November 2022 Security Updates for Exchange Server. Please install those (or newer) updates to address vulnerabilities mentioned in this post. Mitigations are n...
Updated Nov 08, 2022
Version 17.0
Blog Post
2 MIN READ
Customer Guidance for Reported Zero-day Vulnerabilities in Microsoft Exchange Server
Just check log files and saw this
PS C:\inetpub\logs\LogFiles> Get-ChildItem -Recurse -Path C:\inetpub\logs\LogFiles\W3SVC1\ -Filter "*.log" | Select-String -Pattern 'Email=autodiscover\/autodiscover\.json'
C:\inetpub\logs\LogFiles\W3SVC1\u_ex220910.log:128886:2022-09-10 20:18:20 192.168.0.1 GET /autodiscover/autodiscover.json Foo.com/mapi/nspi/?&Email=autodiscover/email address removed for privacy reasons&CorrelationID=<empty>;&cafeReqId=e9f8ce2d-d08b-453a-8228-ad4694ea1a84; 443 - 69.146.0.194
Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/88.0.4324.190+Safari/537.36 - 401 0 0 28
C:\inetpub\logs\LogFiles\W3SVC1\u_ex220917.log:25225:2022-09-17 04:06:16 192.168.0.1 GET /autodiscover/autodiscover.json @evil.corp/ews/exchange.asmx?&Email=autodiscover/email address removed for privacy reasons&CorrelationID=<empty>;&cafeReqId=034af878-aa10-4ea7-80b0-db458df65baf; 443 - 149.255.36.122 python-requests/2.25.1 - 401 0 0 18
C:\inetpub\logs\LogFiles\W3SVC1\u_ex220917.log:25226:2022-09-17 04:06:16 192.168.0.1 POST /autodiscover/autodiscover.json @evil.corp/autodiscover/autodiscover.xml?&Email=autodiscover/email address removed for privacy reasons&CorrelationID=<empty>;&cafeReqId=47ef6829-e575-4f00-b93e-ba014f229fdf; 443 - 149.255.36.122
Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko) - 401 0 0 13
C:\inetpub\logs\LogFiles\W3SVC1\u_ex220917.log:25228:2022-09-17 04:06:21 192.168.0.1 GET /autodiscover/autodiscover.json @evil.corp/ews/exchange.asmx?&Email=autodiscover/email address removed for privacy reasons&CorrelationID=<empty>;&cafeReqId=891e6411-1662-4126-bae5-a4e3cdaf9dfc; 443 - 149.255.36.122 python-requests/2.25.1 - 401 0 0 12
C:\inetpub\logs\LogFiles\W3SVC1\u_ex220917.log:25229:2022-09-17 04:06:21 192.168.0.1 POST /autodiscover/autodiscover.json @evil.corp/autodiscover/autodiscover.xml?&Email=autodiscover/email address removed for privacy reasons&CorrelationID=<empty>;&cafeReqId=987b3291-8d48-4621-9827-a1c0c88c859b; 443 - 149.255.36.122
Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko) - 401 0 0 11
C:\inetpub\logs\LogFiles\W3SVC1\u_ex220917.log:25233:2022-09-17 04:06:25 192.168.0.1 GET /autodiscover/autodiscover.json @evil.corp/ews/exchange.asmx?&Email=autodiscover/email address removed for privacy reasons&CorrelationID=<empty>;&cafeReqId=cfa94a67-58cc-4a19-9a16-cd352d1aad81; 443 - 149.255.36.122 python-requests/2.25.1 - 401 0 0 18
C:\inetpub\logs\LogFiles\W3SVC1\u_ex220917.log:25234:2022-09-17 04:06:25 192.168.0.1 POST /autodiscover/autodiscover.json @evil.corp/autodiscover/autodiscover.xml?&Email=autodiscover/email address removed for privacy reasons&CorrelationID=<empty>;&cafeReqId=32410b4c-608e-4c08-8c56-70dc953d3e39; 443 - 149.255.36.122
Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko) - 401 0 0 8
C:\inetpub\logs\LogFiles\W3SVC1\u_ex221004.log:131139:2022-10-04 14:42:43 192.168.0.1 GET /autodiscover/autodiscover.json @URL/&Email=autodiscover/autodiscover.json%3f@URL&CorrelationID=<empty>;&cafeReqId=17c08731-fdd5-404d-bc3e-1e0a7ff9bd8b; 443 - 95.154.230.15
Mozilla/5.0+(Windows+NT+5.1)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/41.0.2224.3+Safari/537.36 - 404 0 0 161
C:\inetpub\logs\LogFiles\W3SVC1\u_ex221004.log:137707:2022-10-04 15:03:50 192.168.0.1 GET /autodiscover/autodiscover.json @URL/&Email=autodiscover/autodiscover.json%3f@URL&CorrelationID=<empty>;&cafeReqId=9d22e89a-66ab-4161-96ec-cc5c2bed467d; 443 - 95.154.230.15
Mozilla/5.0+(Windows+NT+5.1)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/36.0.1985.67+Safari/537.36 - 404 0 0 17
Should I be concerned?