CISA Orders Agencies to Conduct Fresh Scans of Microsoft Exchange Servers

The Cybersecurity and Infrastructure Security Agency set deadlines for federal agencies to implement supplemental actions under an emergency directive it issued following the abuse of vulnerabilities identified in on-premises Microsoft Exchange servers.

The updated directive CISA released Wednesday requires department-level chief information officers or their equivalents to report to CISA on further investigative actions by noon Monday, April 5 and on defensive measures by noon Monday, June 28.

“CISA is directing additional actions to identify compromises that may remain undetected. Since the original issuance of ED 21-02, Microsoft has developed new tools and techniques to aid organizations in investigating whether their Microsoft Exchange servers have been compromised,” the order reads. “CISA also identified Microsoft Exchange servers still in operation and hosted by (or on behalf of) federal agencies that require additional hardening.”

The more immediate forensic actions CISA listed would have agency personnel working evenings and over the weekend due to the computing power it will take to run two tools—Microsoft Safety Scanner, or MSERT, and Test-ProxyLogon.ps1 script—for identifying indicators of compromise. 

Running MSERT in full scan mode, which CISA requires, “may cause server resource utilization to peak,” the agency said. “Accordingly, CISA recommends agencies run the tool during off-peak hours. The full scan is expected to take several hours. During the scan, files may present as possible matches, but only the final report is conclusive.”

Initial tests must be done by April 5, when the CIO-level reports are due. If there is any positive result from either tool, agencies must immediately report the details to CISA as an incident. 

After the initial MSERT scan, agencies must re-download the tool—it’s often updated, CISA said—and run it every week for a month. Unlike with the first scan, agencies will only need to report any positive results, meaning indicators of compromise, to CISA.

CISA advisories often repeatedly recommend agencies implement cyber hygiene practices such as the use of firewalls, least-privilege access, malware protections and timely software updates. This supplemental directive makes such actions a requirement for the use of Microsoft Exchange servers and their related Active Directory Federation Service, and gives agencies until June 28 to put them in place.

“Given the powerful privileges that Exchange manages by default and the amount of potentially sensitive information that is stored in Exchange servers operated and hosted by (or on behalf of) federal agencies, Exchange servers are a primary target for adversary activity,” CISA wrote.

CISA stressed the importance of identity-based controls and instructed agencies to, among other things, prevent accounts managing on-premises Exchange from having administrative permissions for Microsoft’s cloud-based Office 365 environment. Similarly, no account on an Exchange server should be a member of the domain admin group in the Active Directory, which allows users to move across cloud platforms.

In implementing the required identity controls, CISA said agencies should use tools such as one called BloodHound to “to understand the possible attack path that starts with a compromise of their Exchange infrastructure as the result of compromised Exchange permissions in Active Directory.”

“Attackers use the same methods to discover and abuse weak permission configurations for privilege escalation by taking over other user accounts or adding themselves to groups with high privileges,” CISA said, noting “Exchange is, by default, installed with some of the most powerful privileges in Active Directory, making it a prime target for threat actors.”

CISA’s order also includes agencies configuring their systems to capture and maintain for 180 days all logs from the host operating system, Microsoft Exchange and the associated network. Where possible, this should be done through a separate capability that agencies can actively monitor through their security operations center. The logging issue caught the spotlight after CISA alerts flagged that default Microsoft Office 365 licenses only offered limited logging capabilities.

As the agency pushes to make initiatives like the Continuous Diagnostics and Mitigation program core to securing the federal enterprise going forward, CISA’s directive also requires participating agencies, where possible, to ensure their on-premises Exchange servers can be seen and incorporated into CDM’s monitoring capabilities.  

By April 5, CISA will report cross-agency status and any outstanding issues to the secretary of Homeland Security and the director of the Office of Management and Budget, according to the initial directive.