criticaltestEmerging Threat
HAFNIUM Exchange Exploitation Activity
Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers
windowsprocess_creation
2023-03-09
Emerging Threats
Actor2021
HAFNIUM
2Rules
6References
1Folders
2023-03-09Latest
Summary
HAFNIUM is tracked here as a threat actor, intrusion set, or campaign with 2 Sigma detections spanning 2021. Coverage centers on webserver, windows / process_creation.
Related Detections
Search this threathightestEmerging Threat
Exchange Exploitation Used by HAFNIUM
Detects exploitation attempts in Exchange server logs as described in blog posts reporting on HAFNIUM group activity
Generalwebserver
2023-01-02
References