Tony D
@antonyd22albCompletionist
0 followers22 downloads79 copies3 likes1,033 views
4 detections
Filters
Last updated
All Time
Detection languages
4
MITRE Techniques
1
1
Based on new click fix variant reported on here: https://atos.net/en/lp/cybershield/investigating-a-new-click-fix-variant
Checking for Exchange ActiveSync version 16.1 or higher
From Microsoft: We want to inform our users and organizations about an important upcoming change regarding Exchange ActiveSync (EAS) device connectivity to Exchange Online. Starting March 1, 2026, devices running ActiveSync versions lower than 16.1 will no longer be able to connect to our services. EAS 16.1 was released as a part of Exchange Server and Exchange Online in June 2016.
From Microsoft: We want to inform our users and organizations about an important upcoming change regarding Exchange ActiveSync (EAS) device connectivity to Exchange Online. Starting March 1, 2026, devices running ActiveSync versions lower than 16.1 will no longer be able to connect to our services. EAS 16.1 was released as a part of Exchange Server and Exchange Online in June 2016.
This detection is a simple query for file creation based on the filename and the device where the file was created.
This rule detects HTTP requests containing User-Agent strings associated with the UNC6395 data theft campaign targeting Salesforce instances.