製品の対応
Exchange Serverの脆弱性（CVE-2021-26855等）に対するトレンドマイクロ製品のソリューションは以下となります。
※本ページに掲載されている情報は、2021年3月時点の情報になります。
| トレンドマイクロの対策 | 検出名/ポリシー/ルール名 | ||
| Deep Discovery Inspector Rule | Rule 4527 : CVE-2021-26855 - Exchange Server Side Request Forgery Exploit SB - HTTP (REQUEST) | ||
| Rule 4532: CVE-2021-26855 - Exchange Server Side Request Forgery Exploit - HTTP (REQUEST) - Variant 2 | |||
| Tippingpoint Filter Rule | Rule 39101 : HTTP: Microsoft Exchange Server Side Request Forgery Vulnerability | ||
| Deep Security | Rule 1010854: Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-26855) | ||
| DPI(Deep Packet Inspection) | |||
弊社で確認している、本脆弱性を利用した攻撃キャンペーンに対応したソリューションは以下となります。
| トレンドマイクロの対策 | パターン番号 | リリース日 | 検出名/ポリシー/ルール名 |
| ウィルスパターン (VSAPI/Smart Scan) | 16.585.00 | 10-Mar-21 | Trojan.ASP.SECCHECKER.A |
| 16.583.00 | 9-Mar-21 | Backdoor.ASP.SECCHECHECKER.A | |
| 16.585.00 | 10-Mar-21 | Backdoor.ASP.CHOPPER.ASPGIG | |
| 16.587.00 | 11-Mar-21 | Backdoor.ASP.WEBSHELL.UWMANM | |
| 16.587.00 | 11-Mar-21 | Trojan.PS1.BOXTER.A | |
| スパイウェアパターン (SSAPI/Smart Scan) | 2.389.00 | 10-Mar-21 | HackTool.PS1.PowerCat.A |
| Deep Security DPI(Deep Packet Inspection) |
Rule 1010855: - Microsoft Exchange - HAFNIUM Targeted Vulnerabilities | ||
| Rule 1007170 - Identified Suspicious China Chopper Webshell Communication (ATT&CK T1100) | |||
| Tippingpoint Filter Rule | ThreatDV malware filters | Rule : 39283 HTTP: Covenant Grunt Runtime Detection (Default Profile - Plaintext) | |
| Rule : 39284 HTTP: Covenant Grunt Runtime Detection (Default profile - Base64 Encoded) | |||
| Rule : 39285 HTTP: Backdoor.Shell.Krypcoihilo.A Runtime Detection | |||
| Rule : 39295 HTTP: Whafnium Webshell Payload Detected | |||
| post-exploitation detection filters | Rule : 26898: Tunneling: reGeorg SOCKS Proxy Checkin Traffic | ||
| Rule : 26899: Tunneling: reGeorg SOCKS Proxy Traffic Checkin Response | |||
| Rule : 26900: Tunneling: reGeorg SOCKS Proxy Sending Command Traffic | |||
| Rule : 34152: HTTP: China Chopper PHP Webshell Traffic Detected (My Script RunInBrowser Control Command) | |||
| Rule : 34153: HTTP: China Chopper PHP Webshell Traffic Detected (Control Commands) | |||
| Rule : 34154: HTTP: China Chopper ASP Webshell Traffic Detected (Control Commands) | |||
| Rule : 34257: HTTP: China Chopper ASPX Webshell Traffic Detected (Control Commands) | |||
| Rule : 35779: HTTP: China Chopper ASP/JSP Webshell Payload Detection | |||
| Rule : 36192: HTTP: China Chopper ASP Webshell Payload Only Detection | |||
■SECURITY ALERT: Microsoft Exchange 0-Day Exploit Detection, Protection and Response
https://success.trendmicro.com/solution/000285882