This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Protection from HAFNIUM

Is the protection against the newest Exchange 0 day exploit available or better since what time was that available? This would be helpful for research for Indicators of Compromise (IOCs) in the logs. Or maybe no protection against that is available and I can skip the UTM.

More information can be found here https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

Best

Alex

This thread was automatically locked due to age.

Top Replies

Steve Weißflog over 3 years ago +2

I think because there is no "promotion" on Sophos side it's not safe/secure at the moment. I think just OWA will be safe if you use WAF together with Reverse Authentication. I checked also other vendors…

Parents

0 SayFriedLight over 3 years ago

Hi Alexander,

IOC search should be performed mainly on the Exchange Server and not (only) on the Gateway (EDR and XDR (EAP) can help you achieve this goal faster).

If you allowed direct incoming HTTPS to Exchange (you did wrong;) neither pre-patch IPS nor WAF (MFA maybe;) saved you. Post-patch IPS is for visibility

Mitigate Microsoft Exchange Server Vulnerabilities | CISA

WAF Signatures are not a recommended mitigation though:

Christian Folini on Twitter: "People keep asking me for #ModSecurity rules to protect against the #HAFNIUM attacks / #CVE. But the attacks are very complex and the info I (we?) have is not comprehensive. I would rather have people patch their #Exchange than putting an incomplete set of #WAF rules in front." / Twitter

Regards Steven
Cancel
Vote Up +1 Vote Down

Cancel
0 SayFriedLight over 3 years ago in reply to SayFriedLight

Saerching for IOCs ist just the beginning...since every attacker is jumping on the "opportunistic adversary train" now!

HAFNIUM targeting Exchange Servers with 0-day exploits - Live Discover & Response Query Forum - Intercept X Endpoint - Sophos Community

I think every group and actor are trying to plant their backdoors asap or just seamless upgrade to spread and execute.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 SayFriedLight over 3 years ago in reply to SayFriedLight

Saerching for IOCs ist just the beginning...since every attacker is jumping on the "opportunistic adversary train" now!

HAFNIUM targeting Exchange Servers with 0-day exploits - Live Discover & Response Query Forum - Intercept X Endpoint - Sophos Community

I think every group and actor are trying to plant their backdoors asap or just seamless upgrade to spread and execute.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data