<#
    Checks for IOCs of exploitation of Exchange 0-day Sept 2022
    IOC Information: https://gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html#:~:text=Temporary%20containment%20measures
    Copyright by: connecT SYSTEMHAUS AG

    MIT License

    Copyright (c) 2022 connecT SYSTEMHAUS AG

    Permission is hereby granted, free of charge, to any person obtaining a copy
    of this software and associated documentation files (the "Software"), to deal
    in the Software without restriction, including without limitation the rights
    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
    copies of the Software, and to permit persons to whom the Software is
    furnished to do so, subject to the following conditions:

    The above copyright notice and this permission notice shall be included in all
    copies or substantial portions of the Software.

    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
    SOFTWARE.

#>

#Change if needed
$IISLogPath = 'C:\inetpub\logs\LogFiles\'
$IISRootPath = 'C:\inetpub\wwwroot\'
$ExchangePath = (Get-ItemProperty -Path Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ExchangeServer\v15\Setup).MsiInstallPath

if ($ExchangePath.EndsWith('\'))
{
    $ExchangePath = $ExchangePath.TrimEnd('\')
}

if (!(Test-Path $ExchangePath))
{
    Write-Host "Exchange installation path not found." -ForegroundColor Red
    return
}

function Check-Logs
{
    $iocFound = $false

    if (!(Test-Path $IISLogPath))
    {
        Write-Host "IIS Log Path does not exist. Skipping log check." -ForegroundColor Red
        return
    }

    #IIS logs
    $indicatorLog = (Get-ChildItem -Recurse -Path $IISLogPath -Filter "*.log" | Select-String -Pattern 'powershell.*autodiscover\.json.*\@.*200')

    if (($indicatorLog | Measure).Count -gt 0)
    {
        $iocFound = $true
        Write-Host "IoCs in Log Files found:" -ForegroundColor Red
        $indicatorLog
    }

    if (!$iocFound)
    {
        Write-Host "Check-Logs: No IOC found" -ForegroundColor Green
    }
}

function Check-OWADir
{
    $iocFound = $false

    #*.ashx files
    $ashxFiles = (Get-ChildItem -Recurse -Path (Join-Path -Path $ExchangePath -ChildPath "FrontEnd\HttpProxy\owa\auth") -Filter '*.ashx')

    if (($ashxFiles | Measure).Count -gt 0)
    {
        $iocFound = $true
        Write-Host "Possible *.ashx indicator found:" -ForegroundColor Red
        $ashxFiles                
    }
    
    #File RedirSuiteServiceProxy.aspx
    $iocRedirSuiteServiceProxy = @('65a002fe655dc1751add167cf00adf284c080ab2e97cd386881518d3a31d27f5', 'b5038f1912e7253c7747d2f0fa5310ee8319288f818392298fd92009926268ca')
    $hashRedirSuiteServiceProxy = Get-FileHash (Join-Path -Path $ExchangePath -ChildPath "FrontEnd\HttpProxy\owa\auth\RedirSuiteServiceProxy.aspx")

    if ($iocRedirSuiteServiceProxy.Contains($hashRedirSuiteServiceProxy.Hash))
    {        
        $iocFound = $true
        Write-Host "Indicator for RedirSuiteServiceProxy.aspx hash (FrontEnd\HttpProxy\owa\auth\RedirSuiteServiceProxy.aspx) found" -ForegroundColor Red
    }
    
    #File errorEE.aspx    
    if (Test-Path (Join-Path -Path $ExchangePath -ChildPath "FrontEnd\HttpProxy\owa\auth\errorEE.aspx"))
    {
        $iocFound = $true
        Write-Host "Indicator for errorEE.aspx file found" -ForegroundColor Red

        $iocErrorEE = @('be07bd9310d7a487ca2f49bcdaafb9513c0c8f99921fdf79a05eaba25b52d257')
        $hashErrorEE = Get-FileHash (Join-Path -Path $ExchangePath -ChildPath "FrontEnd\HttpProxy\owa\auth\errorEE.aspx")

        if ($iocErrorEE.Contains($hashErrorEE.Hash))
        {        
            Write-Host "Indicator for errorEE.aspx hash (FrontEnd\HttpProxy\owa\auth\errorEE.aspx) found" -ForegroundColor Red
        }        
    }
    
    if (!$iocFound)
    {
        Write-Host "Check-OWADir: No IOC found" -ForegroundColor Green
    }
}

function Check-IISRoot
{
    $iocFound = $false
    #*.ashx files in IIS root folder
    $ashxFiles = (Get-ChildItem -Recurse -Path (Join-Path -Path $IISRootPath -ChildPath "aspnet_client") -Filter '*.ashx')

    if (($ashxFiles | Measure).Count -gt 0)
    {
        $iocFound = $true
        Write-Host "Possible *.ashx indicator found:" -ForegroundColor Red
        $ashxFiles
    }
    
    if (!$iocFound)
    {
        Write-Host "Check-IISRoot: No IOC found" -ForegroundColor Green
    }
}

function Check-MiscFiles
{
    $iocFound = $false
    $miscFiles = @('C:\root\DrSDKCaller.exe', 'C:\Users\Public\all.exe', 'C:\Users\Public\dump.dll', 'C:\Users\Public\ad.exe', 'C:\PerfLogs\gpg-error.exe', 'C:\PerfLogs\cm.exe')

    foreach ($miscFile in $miscFiles)
    {
        if (Test-Path $miscFile)
        {
            $iocFound = $true
            Write-Host "IOC file $miscFile found"
        }
    }
    
    if (!$iocFound)
    {
        Write-Host "Check-MiscFiles: No IOC found" -ForegroundColor Green
    }
}

Write-Host "Checking for IOCs..."
Write-Host "`r`n"

Check-Logs

Write-Host "`r`n"

Check-OWADir

Write-Host "`r`n"

Check-IISRoot

Write-Host "`r`n"

Check-MiscFiles

Read-Host -Prompt "Please press return key to exit..."