Skip to main content
Skip to main content
Microsoft Security Intelligence
Cart 0 items in shopping cart
Sign in
Published Mar 02, 2021 | Updated Mar 06, 2021

Exploit:Script/Exmann.A!dha

Detected by Microsoft Defender Antivirus

Aliases: No associated aliases

Summary

This threat is being used to attack versions of Microsoft Exchange Server on-premises. In the attacks observed, the threat actor used these vulnerabilities to access Exchange servers on-premises which enabled access to email accounts, and allowed installation of additional malware to facilitate long-term access to target environments.

Microsoft Defender Antivirus automatically removes threats as they are detected. 
 
See the following blogs for details:

Apply the  corresponding security updates for Exchange Server , including applicable fixes for  CVE-2021-26855 ,  CVE-2021-26858 ,  CVE-2021-26857  and  CVE-2021-27065 . While it is important to prioritize patching of internet-facing Exchange servers to mitigate risk in an ordered manner, unpatched internal Exchange Server instances also suffer the same vulnerabilities.

If you are unable to apply security updates to Exchange Server 2013, 2016, and 2019, apply the interim mitigations stated in the Microsoft Security Response Center (MSRC) blogpost  Microsoft Exchange Server Vulnerabilities Mitigations — March 2021 .

Microsoft Defender Antivirus automatically removes threats as they are detected. If you have cloud-delivered protection, your device gets the latest defenses against new and unknown threats. If you don't have this feature enabled, update your antimalware definitions and run a full scan to remove this threat.

To help reduce the impact of this threat, you can:

  • Immediately isolate the affected device. If malicious code has been launched, it is likely that the device is under complete attacker control.
  • Identify the accounts that have been used on the affected device and consider these accounts compromised. Reset passwords or decommission the accounts.
  • Investigate how the affected endpoint might have been compromised. Check web and email traffic to determine how the malware arrived.
  • Investigate the device timeline for indications of lateral movement activities using one of the compromised accounts. Check for additional tools that attackers might have dropped to enable credential access, lateral movement, and other attack activities.

You can also visit our advanced troubleshooting page or search the Microsoft community for more help.

Follow us