Microsoft recently added a new Exchange Server feature that automatically applies interim mitigations for high-risk and likely actively exploited security vulnerabilities to protect on-premises servers from incoming attacks and give administrators more time to install security updates.
This comes after multiple Microsoft Exchange zero-day vulnerabilities were exploited by state-sponsored and financially motivated cybercriminals to impact servers whose administrators did not have patch or mitigation information available.
Microsoft Exchange Emergency Mitigation (EM) service, the name of the new Exchange Server component, builds on Microsoft’s Exchange On-premises Mitigation Tool (EOMT), launched last March to help customers minimize the attack surface exposed by the ProxyLogon bugs.
EM works as a Windows service on Exchange Mailbox servers and is automatically installed on servers with the Mailbox role after the CU is installed on Exchange Server 2016 or Exchange Server 2019 in September 2021.
This works by identifying Exchange Servers vulnerable to one or more known threats and applies interim mitigations until a security update is available for installation.
Automatically applied mitigations via the EM service are temporary solutions until the security update that fixes the vulnerability can be installed, and are not a replacement for Exchange SUs.
Once installed on an Exchange email server, the EM service can perform three types of mitigations:
- IIS URL Rewrite rule mitigation: a rule that blocks certain patterns of malicious HTTP requests that may compromise an Exchange server.
- Exchange service mitigation: disables a vulnerable service on an Exchange server.
- App Pool mitigation: disables a vulnerable app pool on an Exchange server.
Admins can disable the EM service if they prefer not to automatically mitigate their Exchange servers.
They may also control applied mitigations using PowerShell cmdlets and scripts, reapply, block, or delete mitigation actions.
For more information, read the original story in Bleeping Computer.