Hunting in On-Premises Exchange Server logs
Tags
| attack-pattern: | Data Control Panel - T1218.002 Powershell - T1059.001 Server - T1583.004 Server - T1584.004 Software - T1592.002 Powershell - T1086 |
Common Information
| Type | Value |
|---|---|
| UUID | b6eb808c-4f4a-429f-b947-07f35c515e16 |
| Fingerprint | bf0912d7af3490d3 |
| Analysis status | DONE |
| Considered CTI value | 0 |
| Text language | |
| Published | Oct. 7, 2022, 6:55 p.m. |
| Added to db | Jan. 18, 2023, 9:59 p.m. |
| Last updated | Nov. 18, 2024, 1:38 a.m. |
| Headline | Microsoft 365 Security |
| Title | Hunting in On-Premises Exchange Server logs |
| Detected Hints/Tags/Attributes | 26/1/17 |
Source URLs
URL Provider
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | 1 | testing@contoso.com |
||
| Details | File | 1 | devilzshell.aspx |
|
| Details | File | 2 | powershell.aspx |
|
| Details | File | 1209 | powershell.exe |
|
| Details | File | 1 | newmailboxonpremises.aspx |
|
| Details | File | 1 | newdatabase.aspx |
|
| Details | File | 1 | newdag.aspx |
|
| Details | IPv4 | 3 | 10.0.0.11 |
|
| Details | IPv4 | 1 | 20.106.209.84 |
|
| Details | IPv4 | 2 | 106.0.0.0 |
|
| Details | IPv4 | 1 | 20.62.174.61 |
|
| Details | IPv4 | 9 | 15.0.0.0 |
|
| Details | Url | 1 | https://20.62.174.61/aspnet_netclient/4_0_30319/devilzshell.aspx?dir=c: |
|
| Details | Url | 1 | https://20.62.174.61/aspnet_netclient/4_0_30319/powershell.aspx |
|
| Details | Url | 1 | https://exchange.contoso.com:444/ecp/usersgroups/newmailboxonpremises.aspx?pwmcid=3&returnobjecttype=1(https://exchange.contoso.com/ecp/usersgroups/newmailboxonpremises.aspx?pwmcid=3&returnobjecttype=1);s:bld=15.1.1713.5;s:actid=3bbbf798-1dc1-40f8-a56b-0611baa1065d;dbl:budguse.t[]=7.00040006637573;i32:ads.c[dc]=1;f:ads.al[dc]=1.592;i32:ate.c[dc.contoso.com]=0;f:ate.al[dc.contoso.com]=0;s:wlm.bal=2.147484e+09;dbl:wlm.ts |
|
| Details | Url | 1 | https://exchange.contoso.com:444/ecp/dbmgmt/newdatabase.aspx?pwmcid=16&returnobjecttype=1(https://exchange.contoso.com/ecp/dbmgmt/newdatabase.aspx?pwmcid=16&returnobjecttype=1);s:bld=15.1.1713.5;s:actid=d9a2ef05-ef68-4e47-a4d9-d2a80d6180ac;dbl:wlm.ts |
|
| Details | Url | 1 | https://exchange.contoso.com:444/ecp/dbmgmt/newdag.aspx?pwmcid=2&returnobjecttype=1(https://exchange.contoso.com/ecp/dbmgmt/newdag.aspx?pwmcid=2&returnobjecttype=1);s:bld=15.1.1713.5;s:actid=7abb1d23-ee8d-44a5-a3ac-536cdbaeffc2;dbl:wlm.ts |