TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Huntress

ProxyShell vs. ProxyLogon: What's the Difference? | Huntress

2021-08-26 · Read original ↗

ATT&CK techniques detected

4 predictions
T1190Exploit Public-Facing Application
95%
"inviting threat actors to gain “ god mode ” access to their server and do as they please — move laterally through the environment, grab sensitive information, deploy ransomware — you name it. we recommend updating to the latest security patch, monitoring for new indicators of com…"
T1190Exploit Public-Facing Application
92%
"proxyshell vs. proxylogon : what ' s the difference? | huntress the huntress team has been actively researching the proxyshell exploit as well as spreading awareness on how you can protect your environments from this attack. there ’ s some confusion in the community regarding the…"
T1190Exploit Public-Facing Application
65%
"to enter the arena and exploit systems that have not been fully patched to address the original proxylogon vulnerability. at the time of this writing, the scope of the proxylogon exploit far surpasses that of proxyshell. the number of webshells discovered ( so far ) during the pr…"
T1090.002External Proxy
32%
"inviting threat actors to gain “ god mode ” access to their server and do as they please — move laterally through the environment, grab sensitive information, deploy ransomware — you name it. we recommend updating to the latest security patch, monitoring for new indicators of com…"

Summary

We clarify the differences between the ProxyShell (August 2021) and the ProxyLogon (March 2021) exploits impacting Microsoft Exchange on-premises servers.