Microsoft tells Exchange admins to remove some previous antivirus restrictions
>
Some Microsoft Exchange folders and processes, which the company previously suggested, are being excluded from antivirus programs (opens in new tab) scans for stability reasons should no longer be excluded, it has announced.
Explaining the change of heart, Microsoft said the processes no longer affect the stability or performance of Exchange servers, adding that it could even be useful as some threat actors could have hidden backdoors there as well.
Some of the processes and directories contain temporary ASP.NET files, Inetsrv directories, as well as the PowerShell and w3wp processes.
Don’t exclude anymore
“Maintaining these exclusions can prevent detection of IIS web shells and backdoor modules, which represent the most common security vulnerabilities,” the Exchange team said. “We validated that deleting these processes and folders does not affect performance or stability when using Microsoft Defender on Exchange Server 2019 with the latest Exchange Server updates.”
The new recommendations pertain to Exchange Server 2016 and Exchange Server 2013. However, Microsoft added that IT teams should monitor these processes in case something goes wrong.
Here’s a full list of no longer needed exclusions:
- %SystemRoot%Microsoft.NETFramework64v4.0.30319Temporary ASP.NET Files
- %SystemRoot%System32Inetsrv
- %SystemRoot%System32WindowsPowerShellv1.0PowerShell.exe
- %SystemRoot%System32inetsrvw3wp.exe
Threat actors had been observed using malicious Internet Information Services (IIS) web server extensions and modules to add backdoors to unpatched Microsoft Exchange servers.
The best way to stay safe is to always apply the latest Exchange patches and updates, use antivirus tools, limit access to IIS virtual directories, prioritize alerts, and constantly check configuration files and bin directories. inspect for suspicious files, the publication added.
Finally, IT teams should always run the Exchange Server Health Checker script after updates to troubleshoot any misconfiguration issues.
Exchange servers are one of the most popular targets for cybercriminals worldwide, as they are often unprotected or misconfigured. At the same time, many provide a veritable treasure trove of sensitive information that can be sold on the black market or used as leverage for ransom negotiation.
Through: Beeping computer (opens in new tab)