Security News > 2021 > March > Microsoft's MSERT tool now finds web shells from Exchange Server attacks
Microsoft has pushed out a new update for their Microsoft Safety Scanner tool to detect web shells deployed in the recent Exchange Server attacks.
On March 2nd, Microsoft disclosed that four Exchange Server zero-day vulnerabilities were being used in attacks against exposed Outlook on the web servers.
When Microsoft disclosed these attacks, they had released updated signatures for Microsoft Defender that will detect the web shells installed using the zero-day vulnerabilities.
B. For organizations not using Microsoft Defender, Microsoft has added the updated signatures to their Microsoft Safety Scanner standalone tool to help organizations find and remove web shells used in these attacks.
Using Microsoft Safety Scanner to remove web shells.
Microsoft Safety Scanner, also known as the Microsoft Support Emergency Response Tool, is a standalone portable antimalware tool that includes Microsoft Defender signatures to scan for and remove detected malware.
News URL
Related news
- Microsoft Exchange Online outage affects Outlook web users (source)
- Hijacked Microsoft web domain injects spam into SharePoint servers (source)
- Microsoft Uncovers Sandworm Subgroup's Global Cyber Attacks Spanning 15+ Countries (source)
- Microsoft fixes bug causing Windows Server 2025 boot errors (source)
- Microsoft: Hackers steal emails in device code phishing attacks (source)
- New OpenSSH flaws expose SSH servers to MiTM and DoS attacks (source)
- Microsoft's End of Support for Exchange 2016 and 2019: What IT Teams Must Do Now (source)
- Microsoft fixes Power Pages zero-day bug exploited in attacks (source)
- Botnet targets Basic Auth in Microsoft 365 password spray attacks (source)
- New ClickFix attack deploys Havoc C2 via Microsoft Sharepoint (source)