MS Exchange Server event handlers

The predefined Windows Event Log Parser parses MS Exchange Server logs into the SIEM database. You can identify these Fabric logs by the Host OS Family in Log View. These logs are required for the event handlers used in the examples in this topic.

For example, see below where the Host OS Family is MS Exchange.

The following predefined event handlers are available to detect suspicious activities in the MS Exchange Server:

• MS Exchange - Large Email

• MS Exchange - Multiple Failed Deliveries

• MS Exchange - Suspicious Email Activity

The following topology is used for the examples below.

MS Exchange - Large Email

MS Exchange - Large Email is a basic event handler that uses MS Exchange Server logs to detect large email attachments (greater than 10485760 net sent bytes) being transported in the Microsoft Exchange Server.

This event handler uses the predefined data selector Default Microsoft Exchange Transport Log to ensure the proper devices and logs are used to trigger events.

Rule details:

Events triggered by this event handler are visible in the Event Monitor:

You can double-click an event to view the related logs. In this example, there was 14688987 net sent bytes transported in the Microsoft Exchange Server which triggered the event.

MS Exchange - Multiple Failed Deliveries

MS Exchange - Multiple Failed Deliveries is a basic event handler that uses MS Exchange Server logs to detect repeated delivery failures, including bounced messages, to the same recipient that exceeds a threshold. These events indicate potential issues with the recipient address or sender configuration.

This event handler uses the predefined data selector Default Microsoft Exchange Transport Log to ensure the proper devices and logs are used to trigger events.

Rule details:

event_outcome='FAIL' or event_outcome='DSN'

Events triggered by this event handler are visible in the Event Monitor:

You can double-click an event to view the related logs. An email delivery is indicated as FAIL according to the event outcome in the MS Exchange Server log, which triggered the event.

MS Exchange - Suspicious Email Activity

MS Exchange - Suspicious Email Activity is a correlation event handler that detects five failed login attempts followed by email activity. These events may suggest that an attacker has successfully accessed the user account and is attempting to exploit access to the email system, possibly for data exfiltration, spreading malware, or conducting phishing attacks from a legitimate account.

This event handler uses the predefined data selector Default Microsoft Windows Security and Exchange Transport Log to ensure the proper devices and logs are used to trigger events.

• Correlation: This event handler triggers an event when the rule Login Failed 5 Times is followed by Email Activity Detected within 10 minutes with a matching source IP.

• Rule details:

  Rules	Description
  Login Failed 5 Times	Triggered when there are five failed login attempts from the same source IP. Log Field: Source IP Logs that match all of the following filters: Event ID (event_id) = 4625
  Email Activity Detected	Triggered when there is email activity from the matching source IP within 10 minutes of the previous rule being triggered. Log Field: Source IP Logs that match all of the following filters: Event Outcome (event_outcome) = SEND

• Event message: Email activity detected after multiple login failures on ClientIP ${Login Failed 5 Times.groupby1}

• Event Severity: High

• Tags: MSExchange, CredentialAccess, LateralMovement

Events triggered by this event handler are visible in the Event Monitor:

You can double-click an event to view the related logs. The logs that triggered each rule in the correlation sequence can be viewed in the respective tabs: Login Failed 5 Times and Email Activity Detected. The same source IP has multiple failed logins followed by email activity.