Note: this post is getting frequent updates; please keep checking back. Last update: 3/19/2021
Microsoft has released a set of out of band security updates for vulnerabilities for the following ver...
Updated Mar 19, 2021
Version 44.0
Blog Post
Hi, here is attack log. What I now to do? I control with curently publicated information, not found any archive or script
#TYPE Selected.System.Management.Automation.PSCustomObject
"DateTime","AnchorMailbox"
"2021-03-03T07:43:37.416Z","ServerInfo~a]@ex2019.domain.local:444/autodiscover/autodiscover.xml?#"
"2021-03-03T11:14:38.255Z","ServerInfo~a]@ex2019.domain.local:444/autodiscover/autodiscover.xml?#"
"2021-03-03T18:43:54.957Z","ServerInfo~a]@ex2019.domain.local:444/autodiscover/autodiscover.xml?#"
"2021-03-03T18:43:58.072Z","ServerInfo~a]@ex2019.domain.local:444/mapi/emsmdb/?#"
"2021-03-03T18:44:00.546Z","ServerInfo~a]@ex2019.domain.local:444/ecp/proxyLogon.ecp?#"
"2021-03-03T18:44:05.234Z","ServerInfo~a]@ex2019.domain.local:444/ecp/DDI/DDIService.svc/GetObject?msExchEcpCanary=l3mng5BhgE27lLb8pfN-8keyXaQG4NgI7Wk8NusQWN3mijMOgThHZHaHLhXYwJvhwktqCf3Ltao.&schema=OABVirtualDirectory#"
"2021-03-04T16:16:25.344Z","ServerInfo~a]@ex2019.domain.local:444/autodiscover/autodiscover.xml?#"
"2021-03-04T16:16:25.582Z","ServerInfo~a]@ex2019.domain.local:444/mapi/emsmdb/?#"
"2021-03-04T16:16:25.980Z","ServerInfo~a]@ex2019.domain.local:444/ecp/proxyLogon.ecp?#"
"2021-03-04T16:16:27.616Z","ServerInfo~a]@ex2019.domain.local:444/ecp/DDI/DDIService.svc/GetList?msExchEcpCanary=nUsyROhtHEmkUobXEe5RMAbiDjG74NgI0VFvoXVJFo5jQljl8kGbbm2LxVSeznE_-LKDop7nxbQ.&schema=VirtualDirectory#"
"2021-03-04T16:16:30.779Z","ServerInfo~a]@ex2019.domain.local:444/ecp/DDI/DDIService.svc/SetObject?msExchEcpCanary=nUsyROhtHEmkUobXEe5RMAbiDjG74NgI0VFvoXVJFo5jQljl8kGbbm2LxVSeznE_-LKDop7nxbQ.&schema=OABVirtualDirectory#"
"2021-03-04T16:16:30.968Z","ServerInfo~a]@ex2019.domain.local:444/ecp/DDI/DDIService.svc/SetObject?msExchEcpCanary=nUsyROhtHEmkUobXEe5RMAbiDjG74NgI0VFvoXVJFo5jQljl8kGbbm2LxVSeznE_-LKDop7nxbQ.&schema=ResetOABVirtualDirectory#"
"2021-03-04T16:16:32.051Z","ServerInfo~a]@ex2019.domain.local:444/ecp/DDI/DDIService.svc/SetObject?msExchEcpCanary=nUsyROhtHEmkUobXEe5RMAbiDjG74NgI0VFvoXVJFo5jQljl8kGbbm2LxVSeznE_-LKDop7nxbQ.&schema=OABVirtualDirectory#"