troubleshooting Question

Microsoft Exchange Hafnium hack, how to identify when it occurred and how to resolve

Avatar of Dan
DanFlag for United States of America asked on
MicrosoftWindows Server 2016ExchangeSecurity
48 Comments2 Solutions126 ViewsLast Modified:
I ran the MS security tool and windows defender and have confirmed that my organization was affected.
The file was cleaned, but I'm sure there are now back doors.  I have installed the MS security update, so we won't be hacked again, but I have two questions that probably everybody else has:
1. how can I tell on what date the hack occurred, and how can I identify that, the steps?
2. what can I do to clean the servers of any back doors?  I do have backups, so is the best way to build a new server, install the newest exchange CU, with the security update and then try to restore exchange from backup?  I'm just worried I will miss something and it will also restore any affected files or "back doors"?

Any suggestions, thoughts, best course of action going forward?
ASKER CERTIFIED SOLUTION
Join our community to see this answer!
Unlock 2 Answers and 48 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 2 Answers and 48 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros