Forum Discussion
CVE-2021-26855 Exploit Activity found in proxy log reported by running Test-ProxyLogon.ps1
Hi. After running the ps1 file possible suspicious activity was mentioned in the http proxy log. An extenal security company are now looking at the mail server and have said that are domain may...
Hi jasonblake7
Have you checked for presence of any malicious files related to the latest vulnerabilities? Did you run MSERT scanner on the exchange server?
In our environment the proxylogon script has found loads of "suspicious activity" logs, however when I trawled through those logs they all seem to be logins of our support team.
Also, the way I understand it - once you've patched your server there's no need to run EOMT. EOMT is a temporary measure you can put in place until you can fully patch the exchange server. Someone please correct me if I'm wrong.
I may be a cynic but to me it sound's like the external company wants to land itself a big project. Get a second opinion from someone else.