Microsoft Security Blog: Stopping attacks against on-premises Exchange Server and SharePoint Server with AMSI

Apr 9, 2025

—

Source URL: https://www.microsoft.com/en-us/security/blog/2025/04/09/stopping-attacks-against-on-premises-exchange-server-and-sharepoint-server-with-amsi/
Source: Microsoft Security Blog
Title: Stopping attacks against on-premises Exchange Server and SharePoint Server with AMSI

Feedly Summary: Exchange Server and SharePoint Server are business-critical assets and considered crown-jewels for many organizations, making them attractive targets for attacks. To help customers protect their environments and respond to these attacks, Exchange Server and SharePoint Server integrated Windows Antimalware Scan Interface (AMSI), providing an essential layer of protection by preventing harmful web requests from reaching backend endpoints. The blog outlines several attacks prevented by AMSI integration and highlights recent enhancements. The blog also provides protection and mitigation guidance and how defenders can respond.
The post Stopping attacks against on-premises Exchange Server and SharePoint Server with AMSI appeared first on Microsoft Security Blog.

AI Summary and Description: Yes

**Summary:**
The text provides an in-depth overview of the security risks associated with Microsoft Exchange and SharePoint Servers, particularly focusing on how attackers exploit various vulnerabilities, including Server-Side Request Forgery (SSRF) and NTLM relay techniques. The integration of the Antimalware Scan Interface (AMSI) is highlighted as a significant enhancement for detecting and preventing attacks. This is crucial for organizations that rely on these platforms as they navigate increasing threats.

**Detailed Description:**
The content covers a wide range of security implications related to Exchange and SharePoint Servers, emphasizing their critical nature for organizations. Key points include:

– **Vulnerabilities Exploited by Attackers:**
– Attackers have consistently exploited outdated or misconfigured servers to gain unauthorized access, often persisting inside networks undetected.
– Specific vulnerabilities like ProxyShell and ProxyNotShell were noteworthy attackers’ entry points, utilizing a combination of SSRF and privilege escalation.

– **Integration of AMSI:**
– The integration of AMSI to Exchange Server and SharePoint Server acts as an advanced protective layer by preventing harmful web requests from executing.
– AMSI scans incoming requests comprehensively, including request bodies, which is critical for blocking new forms of attacks.

– **Recent Attack Techniques:**
– Description of various attack methodologies, such as NTLM relay attacks through embedded links in Office documents and the deployment of web shells through web control abuses, illustrates the evolving tactics of threat actors.
– Specific cases like CVE-2023-29357 show how attackers have exploited authentication bypass vulnerabilities in SharePoint.

– **Defensive Measures and Guidance:**
– Recommendations for organizations include activating AMSI, applying security updates promptly, and maintaining antivirus protections.
– The importance of practicing least-privilege principles and regularly reviewing sensitive accounts to mitigate risks is emphasized.
– Detailed mitigation strategies are provided, including activating advanced scanning features and utilizing Microsoft Defender’s extensive detection capabilities to handle potential threats.

– **Monitoring and Response:**
– The text outlines how AMSI logs activities, enabling security teams to quickly identify potential compromises. It also discusses the use of Microsoft Defender for Endpoint and vulnerability management tools to proactively address threats.

Overall, the document serves as a crucial resource for security professionals managing Microsoft infrastructure, providing insights into potential vulnerabilities, illustrating various attack scenarios, and offering guidance on effective protective measures against emerging threats.

2 2025 3 4 5 7 a abuse access account Act AGI AI and anti Antimalware Scan Interface antivirus app ARM art as assets attack attack method attack methodologies attack scenario attack scenarios attack techniques attackers attacks authentication Authentication Bypass backend business by bypass bypass vulnerabilities C capabilities CI CIA co content control critical Customer CVE D de Defender defensive measures deployment depth detection detection capabilities document e effective emerging emerging threats end endpoint endpoints environment event Exchange Server exp exploit face feature features first for g gs guidance H harm high Highlight HR http HTTPS implications in infrastructure insights integration inter interface iOS Iron IRS ite J k Key l least led Li Link lm logs making malware man management management tools measures Micro Microsoft Microsoft Defender Microsoft Defender for Endpoint Microsoft Exchange Microsoft Security Microsoft Security Blog mitigation mitigation strategies Monitor monitoring N nation network networks no o of off on organization organizations out over platform platforms point post potential pre premises principles privilege escalation proactive professionals prompt protection protective measures proxy Q QUIC R rate RCE recommendations red resource response Risk risks RMF Ro RoT s scanning sec security security implications security professionals security risk security risks security teams security update security updates server Server-Side Request Forgery servers SHA SharePoint Server side Sig SoC source specific SSE SSO T tactics team Teams tech techniques text the threat threat actor threat actors threats to tool tools Tor TP two UI unauthorized access up update updates US use uth V vulnerabilities vulnerability Vulnerability Management Ware web web shell web shells Wi Wind Windows x