SentinelOne Queries - HAFNIUM Exchange Exploitation

S1Queries_HAFNIUM_Exploitation.md

HAFNIUM WebShell IOCs

Sha256 In ("b75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0","097549cf7d0f76f0d99edf8b2d91c60977fd6a96e4b8c3c94b0b1733dc026d3e","2b6f1ebb2208e93ade4a6424555d6a8341fd6d9f60c25e44afe11008f5c1aad1","65149e036fff06026d80ac9ad4d156332822dc93142cf1a122b1841ec8de34b5","511df0e2df9bfa5521b588cc4bb5f8c5a321801b803394ebc493db1ef3c78fa1","4edc7770464a14f54d17f36dc9d0fe854f68b346b27b35a6f5839adf1f13f8ea","811157f9c7003ba8d17b45eb3cf09bef2cecd2701cedb675274949296a6a183d","1631a90eb5395c4e19c7dbcbf611bbe6444ff312eb7937e286e4637cb9e72944") OR 
( TgtFilePath In Contains Anycase ("web.aspx","help.aspx","document.aspx","errorEE.aspx","errorEEE.aspx","errorEW.aspx","errorFF.aspx","healthcheck.aspx","aspnet_www.aspx","aspnet_client.aspx","xx.aspx","shell.aspx","aspnet_iisstart.aspx","one.aspx")  AND 
TgtFilePath In Contains Anycase ("C:\inetpub\wwwroot\aspnet_client", "C:\inetpub\wwwroot\aspnet_client\system_web", "FrontEnd\HttpProxy\owa\auth") AND
EventType In ("File Creation","File Modification") )

HAFNIUM New UM Service Child Process

SrcProcName In Contains Anycase ("umworkerprocess.exe", "UMService.exe") AND TgtProcName Not In ("UMWorkerProcess.exe", "wermgr.exe", "WerFault.exe","umservice.exe") AND TgtProcName RegExp "!(MSExchange.*.exe|Microsoft.Exchange\..*.exe)"

HAFNIUM UM Service writing suspicious File

SrcProcName In Contains Anycase ("umworkerprocess.exe", "UMService.exe") AND TgtFileExtension In Contains Anycase (".php", ".jsp", ".js", ".aspx", ".asmx", ".asax", ".cfm", ".shtml") AND EventType = "File Creation"

Exchange PowerShell Snap-in being loaded

TgtProcName In ("cmd.exe", "powershell.exe", "PowerShell_ISE.exe") AND TgtProcCmdLine ContainsCIS "Add-PSSnapin Microsoft.Exchange.Powershell.Snapin"

Nishang Invoke-PowerShellTcpOneLine

TgtProcName In ("powershell.exe", "PowerShell_ISE.exe") AND TgtProcCmdLine ContainsCIS "$client = New-Object System.Net.Sockets.TCPClient"

PowerCat Downloads

TgtProcName In ("cmd.exe", "powershell.exe", "PowerShell_ISE.exe") AND TgtProcCmdLine ContainsCIS "https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1"

Added a few more detections for activity noted in the below Microsoft Security blog post.
https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

LSASS dumping should be covered by my T1003.001 LSASS Memory Dumping query.
https://github.com/keyboardcrunch/sentinelone-queries/blob/main/queries/windows/lsass_memory_dumping.yml

PowerCat and other downloads should be covered by my T1566.001 Powershell Download Cradles query.
https://github.com/keyboardcrunch/sentinelone-queries/blob/main/queries/windows/powershell_download_cradles.yml

Adding the Volexity write-up.
https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/

Adding Ryan Kovar's ( twitter.com/meansec ) MITRE ATTACK breakdown and Splunk query teaser.
https://twitter.com/meansec/status/1366919817068961792?s=20