PRC-linked attackers exploit Exchange Server zero-days for code execution

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Four Exchange Server vulnerabilities enable unauthenticated RCE and persistent access; active exploitation and ransomware deployment observed.

CISA and Microsoft disclosed active exploitation of four critical vulnerabilities in on-premises Microsoft Exchange Server 2013, 2016, and 2019. CVE-2021-26855 allows unauthenticated attackers to bypass authentication via Server-Side Request Forgery in the Exchange Control Panel, granting mailbox access and credential theft. Three remote code execution vulnerabilities (CVE-2021-26857, CVE-2021-26858, CVE-2021-27065) enable post-authentication arbitrary file writes and deserialization attacks, leading to SYSTEM-level code execution. Successful exploitation grants persistent access, enables mailbox and credential exfiltration, compromises Active Directory, and facilitates malware deployment including the DearCry ransomware. The activity is attributed to Chinese state-sponsored actors affiliated with the Ministry of State Security. Exploitation is occurring in the wild with attackers deploying webshells (China Chopper variants and others) for persistence and lateral movement. Defenders must prioritize patching immediately or implement network-level mitigations to restrict external access to OWA and ECP endpoints.

title: Exchange Unified Messaging or IIS Worker Spawning Command Shell
id: 46dbe7d8-6fbd-5fbe-bbe1-f36be28c9414
status: experimental
description: Detects Exchange UMWorkerProcess, UMService or w3wp.exe hosting Exchange
  application pools spawning cmd.exe, PowerShell or other script interpreters. Seen
  in ProxyLogon (CVE-2021-26857/26858/27065) exploitation and China Chopper webshell
  command execution.
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1505.004
- attack.execution
- attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_um:
    ParentImage|endswith:
    - \UMWorkerProcess.exe
    - \UMService.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \certutil.exe
    - \bitsadmin.exe
  selection_w3wp:
    ParentImage|endswith: \w3wp.exe
    ParentCommandLine|contains:
    - MSExchange
    - ExchangeServicesAppPool
    - ExchangeCompliance
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \net.exe
    - \whoami.exe
  condition: 1 of selection_*
falsepositives:
- Exchange management scripts or health probes launched under the Exchange app pool
  that invoke cmd.exe
- Third-party Exchange monitoring or backup agents spawning shells from the worker
  process
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-062a

title: Webshell Dropped in Exchange or IIS Web Directories
id: f746199b-b6c6-552c-a34e-85fd5cfb8934
status: experimental
description: Detects aspx/asmx/ashx/asp files written into Exchange FrontEnd HttpProxy
  owa/ecp directories, the OWA auth folder or inetpub wwwroot aspnet_client by w3wp,
  UM or interpreter processes. Typical ProxyLogon arbitrary file write used to plant
  China Chopper style webshells.
tags:
- attack.persistence
- attack.t1505.004
- attack.initial-access
- attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
    - \FrontEnd\HttpProxy\owa\auth\
    - \FrontEnd\HttpProxy\ecp\
    - \inetpub\wwwroot\aspnet_client\
    - \ClientAccess\owa\auth\
    TargetFilename|endswith:
    - .aspx
    - .asmx
    - .ashx
    - .asp
  selection_proc:
    Image|endswith:
    - \w3wp.exe
    - \UMWorkerProcess.exe
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  filter_installer:
    Image|endswith:
    - \msiexec.exe
    - \setup.exe
    - \TrustedInstaller.exe
  condition: selection_path and selection_proc and not filter_installer
falsepositives:
- Exchange cumulative update or security patch installation writing files into the
  front end directories
- Administrators deploying custom OWA pages
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-062a

title: Exchange Server Process Dumping LSASS or Downloading Tools via PowerShell
id: 16060c06-0819-517b-b964-54e26b31dbde
status: experimental
description: Detects post-exploitation commands launched from w3wp.exe, UMWorkerProcess.exe
  or their child shells on Exchange servers, such as comsvcs.dll MiniDump of lsass,
  procdump against lsass, or PowerShell download cradles. Based on ProxyLogon actors
  dumping credentials and pulling tools.
tags:
- attack.credential-access
- attack.t1003
- attack.execution
- attack.t1059.001
- attack.command-and-control
- attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \w3wp.exe
    - \UMWorkerProcess.exe
    - \UMService.exe
  selection_dump:
    CommandLine|contains:
    - comsvcs.dll
    - procdump
    - lsass
    - ntdsutil
    - sekurlsa
  selection_download:
    CommandLine|contains:
    - DownloadString
    - DownloadFile
    - Invoke-WebRequest
    - Net.WebClient
    - Start-BitsTransfer
    - bitsadmin
    - urlcache
  condition: selection_parent and (selection_dump or selection_download)
falsepositives:
- Exchange administrative scripts running from the app pool that legitimately download
  updates
- Security tooling running diagnostics under the IIS worker context
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-062a

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-062a