wiredpulse / invoke-hafniumcheck.ps1

Script used to identify compromise via CVEs 2021-26855, 26857, 26858, and 27065

Invoke-HAFNIUMCheck.ps1

Collects data from Microsoft Exchange Servers that assist in indentifying if the system was exploited via CVEs 2021-26855, 26857, 26858, and 27065. Some analysis is automatically done while other parts requires analysis. The data that is collected is zipped for further movement and analysis.

Script Execution:

1. Download and execute the script on your Microsoft Exchange server.
2. The script will output data to files located within the Temp directory within Windows. There will be output on the screen and anything of interest will have a yellow '[+]'.
3. Once complete, a zip file will be made within the Temp directory

Data Collected:

Version

• Contains the version of the Microsoft Exchange server

HTTPproxy

• Contains specific data in regards to proxy information
• Actor’s exploitation of CVE-2021-26855 can be identified within logs in this directory

OABGeneratorLog

• Contains generation of an Offline Address Book (OAB); downloaded to ‘Program Files’ by default
• Actor has been known to download an OAB to a non-standard location
• Based on the actor’s action, artifacts will be resident here

ECPLogs

• Exchange Control Panel (ECP) is use to configure/ modify an array of features
• Based on the actor’s action, artifacts will be resident here

UnifiedMessaging

• Actor’s exploitation of CVE-2021-26857 can be identified within this event log

HashMatch

• Contains the full path and hash of any .aspx file that matches the known adversary web shell hashes

CompressedFiles

• Contains metadata for items that are compressed
• Actor’s tactic is to create compressed items to stage data for exfiltration

Dumps

• Contains items matching the file header associated with dmp files
• Actor has been known to dump LSASS

Sysinternals

• Contains whether ProcDump or PSExec have been used on the system and when it was first used
• Actor has been known to use ProcDump to dump LSASS and PSExec for other actions
• May not be usable if the organization uses these tools

srudb.dat

• Database of historical data including network connectivity and application resource data
• May not be resident
• Will need to parse the database with another tool

Analysis

Some analysis will be done for the user during execution based on what is known about the actor and resident artifacts. A level of manual analysis is needed for items such as the PowerShell and Process Creation eventlogs.

Screenshot

invoke-hafniumcheck.ps1's Issues

Not working missing a {}

Looks like an excellent script! I cant quite nail down what curly bracket is missing but seems like it starts on line #219.

Feature request: exclude TimeoutLogoff.aspx

Per the CISA Alert you could exclude the "TimeoutLogoff.aspx"

The logs can be found at <exchange install path>\Logging\ECP\Server\.

To determine possible webshell activity, administrators should search for aspx files in the following paths:

\inetpub\wwwroot\aspnet_client\ (any .aspx file under this folder or sub folders)
\<exchange install path>\FrontEnd\HttpProxy\ecp\auth\ (any file besides TimeoutLogoff.aspx)
\<exchange install path>\FrontEnd\HttpProxy\owa\auth\ (any file or modified file that is not part of a standard install)
\<exchange install path>\FrontEnd\HttpProxy\owa\auth\Current\ (any aspx file in this folder or subfolders)
\<exchange install path>\FrontEnd\HttpProxy\owa\auth\<folder with version number>\ (any aspx file in this folder or subfolders)

memory consumption

When running the “Retrieving data for CVE-2021-26855” it consumes all the servers ram an crashes. My server got 32gb of ram but can’t compete the job.

quick debug line 93 $out = Import-Csv.... is where its happending.
the other modules after seem to work fine