Some Microsoft Exchange folders and processes, which the company previously suggested be excluded from antivirus scans for stability reasons, should no longer be excluded, it has announced.
Explaining the change of heart, Microsoft said the processes no longer affect the stability, or the performance, of Exchange servers, adding that it could even be beneficial as some threat actors could have hidden backdoors in there, as well.
Some of the processes and folders include Temporary ASP.NET files, Inetsrv folders, as well as the PowerShell and w3wp processes.
Exclude no more
“Keeping these exclusions may prevent detections of IIS webshells and backdoor modules, which represent the most common security issues,” the Exchange Team said. “We’ve validated that removing these processes and folders doesn’t affect performance or stability when using Microsoft Defender on Exchange Server 2019 running the latest Exchange Server updates.”
The new recommendations affect Exchange Server 2016 and Exchange Server 2013. However, Microsoft added that IT teams should monitor these processes just in case anything goes south.
Here’s a full list of no-longer-needed exclusions:
- %SystemRoot%Microsoft.NETFramework64v4.0.30319Temporary ASP.NET Files
- %SystemRoot%System32Inetsrv
- %SystemRoot%System32WindowsPowerShellv1.0PowerShell.exe
- %SystemRoot%System32inetsrvw3wp.exe
Threat actors had been observed using malicious Internet Information Services (IIS) web server extensions and modules, to add backdoors to unpatched Microsoft Exchange servers.
The best way to stay safe is to always apply the latest Exchange patches and updates, to use antivirus programs, restrict access to IIS virtual directories, prioritize alerts, and constantly inspect config files and bin folders for any suspicious files, the publication added.
Finally, IT teams should always run the Exchange Server Health Checker script after updates, to address any possible misconfiguration issues.
Exchange Servers are one of the most popular targets for cybercriminals worldwide, as they’re often unprotected, or misconfigured. At the same time, many offer a real treasure trove of sensitive information that can be sold on the black market, or used as leverage in a ransom negotiation.
- Check out the best endpoint protection right now
Via: BleepingComputer
