Elastic Docs ›Elastic Security Solution [8.8] ›Detections and alerts ›Prebuilt rule reference
« Microsoft Exchange Server UM Spawning Suspicious Processes Microsoft Exchange Worker Spawning Suspicious Processes »

Microsoft Exchange Server UM Writing Suspicious Filesedit

Identifies suspicious files being written by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26858.

Rule type: eql

Rule indices:

  • winlogbeat-*
  • logs-endpoint.events.*
  • logs-windows.*

Severity: medium

Risk score: 47

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Initial Access

Version: 100 (version history)

Added (Elastic Stack release): 7.12.0

Last modified (Elastic Stack release): 8.5.0

Rule authors: Elastic, Austin Songer

Rule license: Elastic License v2

Potential false positivesedit

Files generated during installation will generate a lot of noise, so the rule should only be enabled after the fact. This rule was tuned using the following baseline: https://raw.githubusercontent.com/microsoft/CSS-Exchange/main/Security/Baselines/baseline_15.2.792.5.csv from Microsoft. Depending on version, consult https://github.com/microsoft/CSS-Exchange/tree/main/Security/Baselines to help determine normalcy.

Investigation guideedit

## Triage and analysis

Positive hits can be checked against the established Microsoft [baselines](https://github.com/microsoft/CSS-Exchange/tree/main/Security/Baselines).

Microsoft highly recommends that the best course of action is patching, but this may not protect already compromised systems
from existing intrusions. Other tools for detecting and mitigating can be found within their Exchange support
[repository](https://github.com/microsoft/CSS-Exchange/tree/main/Security)

Rule queryedit

file where event.type == "creation" and process.name :
("UMWorkerProcess.exe", "umservice.exe") and file.extension :
("php", "jsp", "js", "aspx", "asmx", "asax", "cfm", "shtml") and (
file.path : "?:\\inetpub\\wwwroot\\aspnet_client\\*" or
(file.path : "?:\\*\\Microsoft\\Exchange
Server*\\FrontEnd\\HttpProxy\\owa\\auth\\*" and not (file.path
: "?:\\*\\Microsoft\\Exchange
Server*\\FrontEnd\\HttpProxy\\owa\\auth\\version\\*" or
file.name : ("errorFE.aspx", "expiredpassword.aspx", "frowny.aspx",
"GetIdToken.htm", "logoff.aspx", "logon.aspx",
"OutlookCN.aspx", "RedirSuiteServiceProxy.aspx", "signout.aspx"))) or
(file.path : "?:\\*\\Microsoft\\Exchange
Server*\\FrontEnd\\HttpProxy\\ecp\\auth\\*" and not file.name :
"TimeoutLogoff.aspx") )

Threat mappingedit

Framework: MITRE ATT&CKTM

Rule version historyedit

Version 100 (8.5.0 release)
  • Formatting only
Version 5 (8.4.0 release)
  • Formatting only
Version 3 (8.2.0 release)
  • Formatting only
Version 2 (7.13.0 release)

  • Updated query, changed from:

    file where event.type == "creation" and process.parent.name :
("UMWorkerProcess.exe", "umservice.exe") and file.extension :
("php", "jsp", "js", "aspx", "asmx", "asax", "cfm", "shtml") and (
file.path : ("C:\\inetpub\\wwwroot\\aspnet_client\\*",
"C:\\*\\FrontEnd\\HttpProxy\\owa\\auth\\*") or (file.path :
"C:\\*\\FrontEnd\\HttpProxy\\ecp\\auth\\*" and not file.name :
"TimeoutLogoff.aspx") )
« Microsoft Exchange Server UM Spawning Suspicious Processes Microsoft Exchange Worker Spawning Suspicious Processes »