I patched on 3/3 This just looks like we were probed and not compromised, can some one please confirm? I’m not sure how to interpret this. Ran Test-Hafnium.ps1 Contents of CVE-2021-26855.log #TYPE Selected.System.Management.Automation.PSCustomObject "DateTime","AnchorMailbox" "2021-03-02T09:50:56.279Z","ServerInfo~a]@Exchange001.contoso.com:444/autodiscover/autodiscover.xml?#" edit: The scan found the following entry 2021-03-02T09:50:56.279Z,5f083d36-1b8a-489b-9bdc-e3859dea08f4,15,1,2106,2,,Ecp,207.207.49.16,/ecp/y.js,,FBA,false,,,ServerInfo~a]@Exchange001.contoso.com:444/autodiscover/autodiscover.xml?#,ExchangeServicesClient/0.0.0.0,157.230.221.198,EXCHANGE001,200,200,,POST,Proxy,exchange001.contoso.com,15.00.0001.000,IntraForest,X-BEResource-Cookie,,,,347,362,,,0,0,,0,,0,,0,0,,0,295,0,0,17,0,274,0,0,0,1,0,294,1,274,4,21,21,295,,,,BeginRequest=2021-03-02T09:50:55.983Z;CorrelationID=;ProxyState-Run=None;FEAuth=BEVersion-1941962753;NewConnection=::1&0;BeginGetRequestStream=2021-03-02T09:50:55.983Z;OnRequestStreamReady=2021-03-02T09:50:55.998Z;BeginGetResponse=2021-03-02T09:50:55.998Z;OnResponseReady=2021-03-02T09:50:56.279Z;EndGetResponse=2021-03-02T09:50:56.279Z;ProxyState-Complete=ProxyResponseData;SharedCacheGuard=0;EndRequest=2021-03-02T09:50:56.279Z;,,,,,,CafeV1 In the following file "\exchange001.contoso.com\C$\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Ecp\HttpProxy_2021030209-1.LOG" I did not find any […]
Categories
CVE-2021-26855 Explanation
- Post author By Server Questions
- Post date March 4, 2021
- No Comments on CVE-2021-26855 Explanation
- Tags "AnchorMailbox" "2021-03-02T09:50:56.279Z", "ServerInfo~a]@Exchange001.contoso.com:444/autodiscover/autodiscover.xml?#" edit: The scan found the following entry 2021-03-02T09:50:56.27, /ecp/y.js, 0, 1, 15, 15.00.0001.000, 157.230.221.198, 17, 2, 200, 207.207.49.16, 21, 2106, 274, 294, 295, 347, 362, 4, 5f083d36-1b8a-489b-9bdc-e3859dea08f4, BeginRequest=2021-03-02T09:50:55.983Z;CorrelationID=;ProxyState-Run=None;FEAuth=BEVersion-1941962753;NewConnection=::1&0;BeginGetRequestStrea, CafeV1 In the following file "\exchange001.contoso.com\C$\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Ecp\HttpProxy_20210, can some one please confirm? I'm not sure how to interpret this. Ran Test-Hafnium.ps1 Contents of CVE-2021-26855.log #TYPE Selected.System, Ecp, EXCHANGE001, exchange001.contoso.com, ExchangeServicesClient/0.0.0.0, false, FBA, I patched on 3/3 This just looks like we were probed and not compromised, IntraForest, post, proxy, ServerInfo~a]@Exchange001.contoso.com:444/autodiscover/autodiscover.xml?#, X-BEResource-Cookie