Protection against Exchange ProxyLogon exploit.

[gstephan]

Hi all!

Is there any guidance from FortiNet or from the community how to protect agains the most recent MS Exchange attacks?

Thanks,

Stephan

[Jeff_Roback]

This website discusses Fortinet's response to the exploits: 

https://www.fortinet.com/blog/threat-research/fortinet-addresses-latest-microsoft-exchange-server-ex...

Based on this website it sounds like the following IPS signatures are what you're looking for:

FortiGuard IPS

The following IPS signatures were released on March 3-4, 2021 to detect and stop exploits targeting the four vulnerabilities identified in this exploit. All Fortinet customers with an active subscription and current update are already protected.

MS.Exchange.Server.ProxyRequestHandler.Remote.Code.Execution MS.Exchange.Server.UM.Core.Remote.Code.Execution MS.Exchange.Server.CVE-2021-27065.Remote.Code.Execution   MS.Exchange.Server.CVE-2021-26858.Remote.Code.Execution