Security News > 2021 > March > Microsoft's MSERT tool now finds web shells from Exchange Server attacks
Microsoft has pushed out a new update for their Microsoft Safety Scanner tool to detect web shells deployed in the recent Exchange Server attacks.
On March 2nd, Microsoft disclosed that four Exchange Server zero-day vulnerabilities were being used in attacks against exposed Outlook on the web servers.
When Microsoft disclosed these attacks, they had released updated signatures for Microsoft Defender that will detect the web shells installed using the zero-day vulnerabilities.
B. For organizations not using Microsoft Defender, Microsoft has added the updated signatures to their Microsoft Safety Scanner standalone tool to help organizations find and remove web shells used in these attacks.
Using Microsoft Safety Scanner to remove web shells.
Microsoft Safety Scanner, also known as the Microsoft Support Emergency Response Tool, is a standalone portable antimalware tool that includes Microsoft Defender signatures to scan for and remove detected malware.
News URL
Related news
- Rackspace internal monitoring web servers hit by zero-day (source)
- DOJ, Microsoft seize 107 domains used in Russia's Star Blizzard phishing attacks (source)
- Microsoft and DOJ disrupt Russian FSB hackers' attack infrastructure (source)
- Microsoft fixes Remote Desktop issues caused by Windows Server update (source)
- New scanner finds Linux, UNIX servers exposed to CUPS RCE attacks (source)
- Microsoft issues 117 patches – some for flaws already under attack (source)
- Microsoft Detects Growing Use of File Hosting Services in Business Email Compromise Attacks (source)
- Microsoft deprecates PPTP and L2TP VPN protocols in Windows Server (source)
- Finland seizes servers of 'Sipultie' dark web drugs market (source)
- SolarWinds Web Help Desk flaw is now exploited in attacks (source)