Outlook Web Access provides the ability to domain users to access their mailbox externally. Apply Critical Security Patches & Workaroundsĭefault installations of Microsoft Exchange have the following services enabled:Īll of these services create an attack surface that threat actors could benefit by conducting attacks that could lead to discovery of legitimate credentials, getting access to mailbox of users and perform domain escalation.The following diagram demonstrates real world attacks that are implemented by threat actors in order to achieve full domain compromise by abusing Exchange services, Exchange API and standard Outlook functionality.īlocking these attacks require a series of measures that organisations should implement to reduce the risk of a security breach via Microsoft Exchange connections. Compromising the domain of the organisation via Exchange connections can become a trivial task especially if a number of security controls are missing. Microsoft Exchange servers are common target for threat actors not only because they provide multiple entry points but because they offer opportunities for persistence and domain escalation as they are bind to the Active Directory.

Microsoft activesync tester