This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.
« Microsoft Exchange Server UM Spawning Suspicious Processes Microsoft Exchange Worker Spawning Suspicious Processes »
Elastic Docs ›Elastic Security Solution [8.16] ›Detections and alerts ›Prebuilt rule reference

Microsoft Exchange Server UM Writing Suspicious Files

edit

Microsoft Exchange Server UM Writing Suspicious Files

edit

Identifies suspicious files being written by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26858.

Rule type: eql

Rule indices:

  • winlogbeat-*
  • logs-endpoint.events.*
  • logs-windows.*

Severity: medium

Risk score: 47

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Initial Access

Version: 100 (version history)

Added (Elastic Stack release): 7.12.0

Last modified (Elastic Stack release): 8.5.0

Rule authors: Elastic, Austin Songer

Rule license: Elastic License v2

Potential false positives

edit

Files generated during installation will generate a lot of noise, so the rule should only be enabled after the fact. This rule was tuned using the following baseline: https://raw.githubusercontent.com/microsoft/CSS-Exchange/main/Security/Baselines/baseline_15.2.792.5.csv from Microsoft. Depending on version, consult https://github.com/microsoft/CSS-Exchange/tree/main/Security/Baselines to help determine normalcy.

Investigation guide

edit
## Triage and analysis

Positive hits can be checked against the established Microsoft [baselines](https://github.com/microsoft/CSS-Exchange/tree/main/Security/Baselines).

Microsoft highly recommends that the best course of action is patching, but this may not protect already compromised systems
from existing intrusions. Other tools for detecting and mitigating can be found within their Exchange support
[repository](https://github.com/microsoft/CSS-Exchange/tree/main/Security)

Rule query

edit
file where event.type == "creation" and process.name :
("UMWorkerProcess.exe", "umservice.exe") and file.extension :
("php", "jsp", "js", "aspx", "asmx", "asax", "cfm", "shtml") and (
file.path : "?:\\inetpub\\wwwroot\\aspnet_client\\*" or
(file.path : "?:\\*\\Microsoft\\Exchange
Server*\\FrontEnd\\HttpProxy\\owa\\auth\\*" and not (file.path
: "?:\\*\\Microsoft\\Exchange
Server*\\FrontEnd\\HttpProxy\\owa\\auth\\version\\*" or
file.name : ("errorFE.aspx", "expiredpassword.aspx", "frowny.aspx",
"GetIdToken.htm", "logoff.aspx", "logon.aspx",
"OutlookCN.aspx", "RedirSuiteServiceProxy.aspx", "signout.aspx"))) or
(file.path : "?:\\*\\Microsoft\\Exchange
Server*\\FrontEnd\\HttpProxy\\ecp\\auth\\*" and not file.name :
"TimeoutLogoff.aspx") )

Threat mapping

edit

Framework: MITRE ATT&CKTM

Rule version history

edit
Version 100 (8.5.0 release)
  • Formatting only
Version 5 (8.4.0 release)
  • Formatting only
Version 3 (8.2.0 release)
  • Formatting only
Version 2 (7.13.0 release)

  • Updated query, changed from:

    file where event.type == "creation" and process.parent.name :
("UMWorkerProcess.exe", "umservice.exe") and file.extension :
("php", "jsp", "js", "aspx", "asmx", "asax", "cfm", "shtml") and (
file.path : ("C:\\inetpub\\wwwroot\\aspnet_client\\*",
"C:\\*\\FrontEnd\\HttpProxy\\owa\\auth\\*") or (file.path :
"C:\\*\\FrontEnd\\HttpProxy\\ecp\\auth\\*" and not file.name :
"TimeoutLogoff.aspx") )
« Microsoft Exchange Server UM Spawning Suspicious Processes Microsoft Exchange Worker Spawning Suspicious Processes »