Microsoft tells Exchange admins to remove some previous antivirus restrictions

Some Microsoft Exchange folders and processes, which the company previously suggested be excluded from antivirus scans for stability reaso...

Some Microsoft Exchange folders and processes, which the company previously suggested be excluded from antivirus scans for stability reasons, should no longer be excluded, it has announced.

Explaining the change of heart, Microsoft said the processes no longer affect the stability, or the performance, of Exchange servers, adding that it could even be beneficial as some threat actors could have hidden backdoors in there, as well.

Some of the processes and folders include Temporary ASP.NET files, Inetsrv folders, as well as the PowerShell and w3wp processes.

Exclude no more

"Keeping these exclusions may prevent detections of IIS webshells and backdoor modules, which represent the most common security issues," the Exchange Team said. "We've validated that removing these processes and folders doesn't affect performance or stability when using Microsoft Defender on Exchange Server 2019 running the latest Exchange Server updates."

The new recommendations affect Exchange Server 2016 and Exchange Server 2013. However, Microsoft added that IT teams should monitor these processes just in case anything goes south. 

Here’s a full list of no-longer-needed exclusions:

  • %SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files
  • %SystemRoot%\System32\Inetsrv
  • %SystemRoot%\System32\WindowsPowerShell\v1.0\PowerShell.exe
  • %SystemRoot%\System32\inetsrv\w3wp.exe

Threat actors had been observed using malicious Internet Information Services (IIS) web server extensions and modules, to add backdoors to unpatched Microsoft Exchange servers.

The best way to stay safe is to always apply the latest Exchange patches and updates, to use antivirus programs, restrict access to IIS virtual directories, prioritize alerts, and constantly inspect config files and bin folders for any suspicious files, the publication added. 

Finally, IT teams should always run the Exchange Server Health Checker script after updates, to address any possible misconfiguration issues. 

Exchange Servers are one of the most popular targets for cybercriminals worldwide, as they’re often unprotected, or misconfigured. At the same time, many offer a real treasure trove of sensitive information that can be sold on the black market, or used as leverage in a ransom negotiation.

Via: BleepingComputer



from TechRadar - All the latest technology news https://ift.tt/j8kolfv
via IFTTT

COMMENTS

BLOGGER
Name

Apps,3858,Business,151,Camera,1155,Earn $$$,3,Gadgets,1741,Games,926,GTA,1,Innovations,3,Mobile,1697,Paid Promotions,5,Promotions,5,Sports,1,Technology,8106,Trailers,796,Travel,37,Trending,4,Trendly News,25335,TrendlyNews,110,Video,5,XIAOMI,13,YouTube - 9to5Google,109,
ltr
item
Trendly News | #ListenNow #Everyday #100ShortNews #TopTrendings #PopularNews #Reviews #TrendlyNews: Microsoft tells Exchange admins to remove some previous antivirus restrictions
Microsoft tells Exchange admins to remove some previous antivirus restrictions
Trendly News | #ListenNow #Everyday #100ShortNews #TopTrendings #PopularNews #Reviews #TrendlyNews
http://www.trendlynews.in/2023/02/microsoft-tells-exchange-admins-to.html
http://www.trendlynews.in/
http://www.trendlynews.in/
http://www.trendlynews.in/2023/02/microsoft-tells-exchange-admins-to.html
true
3372890392287038985
UTF-8
Loaded All Posts Not found any posts VIEW ALL Readmore Reply Cancel reply Delete By Home PAGES POSTS View All RECOMMENDED FOR YOU LABEL ARCHIVE SEARCH ALL POSTS Not found any post match with your request Back Home Sunday Monday Tuesday Wednesday Thursday Friday Saturday Sun Mon Tue Wed Thu Fri Sat January February March April May June July August September October November December Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec just now 1 minute ago $$1$$ minutes ago 1 hour ago $$1$$ hours ago Yesterday $$1$$ days ago $$1$$ weeks ago more than 5 weeks ago Followers Follow THIS PREMIUM CONTENT IS LOCKED STEP 1: Share. STEP 2: Click the link you shared to unlock Copy All Code Select All Code All codes were copied to your clipboard Can not copy the codes / texts, please press [CTRL]+[C] (or CMD+C with Mac) to copy