Forum Discussion
Suspicious events
Exchange 2016 fully patched. Saw a few errors in Application log. Source: MSExchange Front End HTTP Proxy [Owa] An internal server error occurred. The unhandled exception was: System.ArgumentEx...
MS_Tech_user1875 Do you got any feedback from MS? I see this events on fully patched exchange servers 2013 & 2016, at all of the servers the Test-ProxyLogon.ps1 found entries and webshells like discovery.aspx. Every server was cleaned and daily checked with ps scripts, msert scan. All the bad IPs are blocked Before we blocked the bad IPs, we get the same events ASP.NET 4.... Web Event with owa an x.js Files.
what is unclear to me, is this still a problem which indicates a compromise or active hacker access or are these prevented access attempts and the server is safe for now?