Rapid7’s InsightIDR Enables Detection And Response to Microsoft Exchange 0-day

Andrew Christian — Wed, 03 Mar 2021 00:41:04 +0000

Starting February 27, 2021, Rapid7 has observed a notable increase in the exploitation of Microsoft Exchange through existing detections in InsightIDR’s Attacker Behavior Analytics (ABA). The Managed Detection and Response (MDR) identified multiple, related compromises in the past 72 hours. In most cases, the attacker is uploading an “eval”

Indiscriminate Exploitation of Microsoft Exchange Servers (CVE-2021-24085)

Andrew Christian — Tue, 02 Mar 2021 19:53:28 +0000

Rapid7's MDR team has observed a notable increase in the automated exploitation of vulnerable Microsoft Exchange servers to upload a webshell granting attackers remote access.

Andrew Christian – Noise

Rapid7’s InsightIDR Enables Detection And Response to Microsoft Exchange 0-day

Indiscriminate Exploitation of Microsoft Exchange Servers (CVE-2021-24085)