Fab Ri (Customer) asked a question.
Hello,
in our TEST environment we use a LoadMaster VLM-3000. We created some rules literally years ago and not checked them anymore.
Yesterday, strangely enough, to debug a not responding endpoint I noticed some rules that I think means the loadmaster has been compromised:
ActiveSync_20721 RegEx Ignore Case /^\/microsoft-server-activesync.*/
ActiveSync_25151 RegEx Ignore Case /^\/microsoft-server-activesync.*/
ActiveSync_29336 RegEx Ignore Case /^\/microsoft-server-activesync.*/
Authentication_Proxy_20985 RegEx Ignore Case /^\/lm_auth_proxy*$/
Autodiscover_20721 RegEx Ignore Case /^\/autodiscover.*/
Autodiscover_25151 RegEx Ignore Case /^\/autodiscover.*/
Autodiscover_29336 RegEx Ignore Case /^\/autodiscover.*/
ECP_20721 RegEx Ignore Case /^\/ecp.*/
ECP_25151 RegEx Ignore Case /^\/ecp.*/
ECP_29336 RegEx Ignore Case /^\/ecp.*/
EWS_20721 RegEx Ignore Case /^\/ews.*/
EWS_25151 RegEx Ignore Case /^\/ews.*/
EWS_29336 RegEx Ignore Case /^\/ews.*/
MAPI_20721 RegEx Ignore Case /^\/mapi.*/
MAPI_25151 RegEx Ignore Case /^\/mapi.*/
MAPI_29336 RegEx Ignore Case /^\/mapi.*/
OAB_20721 RegEx Ignore Case /^\/oab.*/
OAB_25151 RegEx Ignore Case /^\/oab.*/
OAB_29336 RegEx Ignore Case /^\/oab.*/
OWA_20721 RegEx Ignore Case /^\/owa.*/
OWA_25151 RegEx Ignore Case /^\/owa.*/
OWA_29336 RegEx Ignore Case /^\/owa.*/
and these ones even more scary:
PowerShell_20721 RegEx Ignore Case /^\/powershell.*/
PowerShell_25151 RegEx Ignore Case /^\/powershell.*/
PowerShell_29336 RegEx Ignore Case /^\/powershell.*/
RPC_20721 RegEx Ignore Case /^\/rpc.*/
RPC_25151 RegEx Ignore Case /^\/rpc.*/
RPC_29336 RegEx Ignore Case /^\/rpc.*/
Root_20721 RegEx /^\/$/
Root_25151 RegEx /^\/$/
Root_29336 RegEx /^\/$/
biPattern RegEx Ignore Case /^\/reports_bi_olap.*/
Header Modification Rules
Name Rule Type Options Header Pattern Replacement In Use Operation
Redirect_Root_20721 Modify URL /^\/$/ /owa
Redirect_Root_20985 Modify URL /^\/$/ /owa
Redirect_Root_25151 Modify URL /^\/$/ /owa
Redirect_Root_29336 Modify URL /^\/$/ /owa
Maybe we have been hacked somehow (very likely I'd say) or maybe are standard rules added by some template ? We do not have this in PROD environment.
Thanks for help
Hello,
From the content rules you provided here, these appear to be the ones which come standard with our Microsoft Exchange Template
Creating multiple virtual services using one of these provided templates will also create duplicates of said rules. This is why you see many of the same exact rules here using slightly different names.
I've attached a screenshot of these rules on one of my own loadmasters. These were generated automatically after I created a virtual service using the "Exchange 2019 HTTPS re-encrypted with ESP" template as an example.
Let us know if you have any other questions or concerns.
Thank you!