Skip to content

Add readme for CompareExchangeHashes script #166

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bill-long merged 2 commits into from
Mar 9, 2021
Merged

Add readme for CompareExchangeHashes script #166

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0b215c1
Add readme for CompareExchangeHashes script
anshuldube Mar 9, 2021
8993bed
Update
anshuldube Mar 9, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions Security/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,30 @@ To rollback multiple or specific mitigations

`.\ExchangeMitigations.ps1 -WebSiteNames "Default Web Site" -RollbackECPAppPoolMitigation -RollbackOABAppPoolMitigation`

## CompareExchangeHashes.ps1
This script provides a mechanism for malicious file detection on Exchange servers running E13, E16 or E19 versions.
For more information please go to https://aka.ms/exchangevulns

The script currently only validates files in exchange virtual directories only, it does not check any files in the IIS root.
**This script needs to be run as administrator**

The script determines the version of exchange installed on the server and then downloads the hashes for known exchange files from the [published known good hashes of exchange files](https://github.com/microsoft/CSS-Exchange/releases/latest)

The result generated is stored in a file locally with the following format: <ExchangeVersion>_result.csv
If potential malicious files are found during comparision there is an error generated on the cmdline.

To read the output:
Open the result csv file in excel or in powershell:
`$result = Import-Csv <Path to result file>

Submitting files for analysis:
* Please submit the output file for analysis in the malware analysis portal [here](https://www.microsoft.com/en-us/wdsi/filesubmission). Please add the text "ExchangeMarchCVE" in "Additional Information" field on the portal submission form.
* Instructions on how to use the portal can be found [here](https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/submission-guide)

[Download CompareExchangeHashes.ps1](https://github.com/microsoft/CSS-Exchange/releases/download/v21.03.08.2328/CompareExchangeHashes.ps1)

`.\CompareExchangeHashes.ps1

## BackendCookieMitigation.ps1

This mitigation will filter https requests that contain malicious X-AnonResource-Backend and malformed X-BEResource cookies which were found to be used in CVE-2021-26855.
Expand Down