Detect ZeroT by looking for compromise indicators on Microsoft Exchange servers, including unusual web shell-like behaviour, suspicious child processes, and abnormal outbound connections from the mail host. Correlate IIS, authentication, and endpoint telemetry, then inspect for modified server files and any signs of post-exploitation activity.
What ZeroT compromise looks like in Exchange telemetry
Detection starts with the host, because ZeroT is most visible once it has touched Microsoft Exchange. Hunt for web shell-like file activity in web directories, suspicious process spawning from the mail server, and outbound connections that do not fit normal mail flow. The key is to treat Exchange as both an application server and a post-exploitation foothold, not just a messaging platform.
For Exchange-focused hunting, a malware and intrusion playbook such as Malware Guide is useful because the same behavioural patterns that flag commodity malware also apply when attackers drop shells, stage tools, or pivot from the mail host.
Look for process ancestry that should not exist in routine administration, especially service processes spawning scripting interpreters, archive tools, or command shells. Correlate that with IIS logs, file write times, and host telemetry so you can distinguish legitimate Exchange maintenance from post-exploitation activity.
Which signals should be correlated first?
The strongest detections usually come from correlation, not from any single event. IIS logs can show unusual requests that precede file drops, authentication logs can show suspicious sign-ins or token abuse, and endpoint telemetry can reveal the follow-on process tree. When those signals line up on the same server, the probability of compromise rises quickly.
Outbound traffic matters as much as inbound access. A mail server that suddenly reaches unfamiliar external hosts, especially after suspicious file or process activity, is a stronger indicator than a single noisy log event. Inspect DNS, proxy, and firewall telemetry together so you can see whether the server is beaconing, staging data, or downloading a second-stage payload.
Framework mapping is straightforward here: use the MITRE ATT&CK Enterprise Matrix to map observed behaviour to credential access, persistence, lateral movement, and post-exploitation activity, and use SANS Security Resources for incident-handling patterns that help analysts turn scattered indicators into a coherent timeline.
How to confirm compromise without overcalling benign admin activity
Exchange servers often generate noisy background activity, so verification requires discipline. Check whether suspicious files changed outside maintenance windows, whether the parent process chain fits an admin workflow, and whether the outbound destination matches any approved update, backup, or monitoring service. If not, treat the host as potentially compromised until proven otherwise.
Validate file integrity on the web root and adjacent application paths, then compare the current state with known-good baselines or backup images. If you see web shell-like artefacts, unexplained child processes, or evidence that the server is contacting an external command source, assume the attacker may have already used the server for follow-on actions and broaden the investigation beyond the original entry point.
Risk and Threat Considerations
Exchange compromise is high-risk because the mail server often sits near credentials, internal workflows, and sensitive correspondence. Attackers value it as a durable foothold: once they gain execution, they can persist, harvest data, and move laterally while blending into expected administrative and mail traffic.
Failure mechanism: The defender focuses on a single indicator, such as a suspicious file, and misses the wider chain of IIS abuse, process creation, and outbound staging that shows the host is already under attacker control.
Impact: Delayed detection can allow persistence, mailbox access, internal reconnaissance, and further compromise from a system that security teams still assume is only serving email.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1505.003 — Server Software Component: Web Shell | ZeroT detection centers on web shell-like Exchange activity and post-exploitation behavior. |
| T1059 — Command and Scripting Interpreter | Suspicious child processes and script execution are key Exchange compromise indicators. | |
| Recommendation — Map suspicious Exchange activity to web-shell persistence and hunt for follow-on post-exploitation actions. Trace anomalous process chains from Exchange into script or shell execution paths. | ||
| NIST CSF 2.0 | DE.CM-01 — Anomalous and Suspicious Events are Detected | The question is about detecting compromise through correlated telemetry on Exchange hosts. |
| DE.AE-02 — Analyzed Events to Understand Attack Objectives and Methods | Investigating ZeroT requires interpreting indicators as an attack chain, not isolated alerts. | |
| Recommendation — Correlate host, IIS, auth, and network telemetry to identify suspicious Exchange activity. Analyze linked events to reconstruct attacker activity on the mail server. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Detection depends on reviewing IIS, authentication, and endpoint logs for suspicious patterns. |
| Recommendation — Review and correlate logs to surface compromise indicators on Exchange. | ||
Practitioner Guidance
What to prioritise: Start with the Exchange hosts that show any combination of web directory changes, unusual child processes, and external connections. Those three signals together are more actionable than broad mailbox alerting alone.
What to verify: Confirm whether the observed activity matches an approved maintenance task, patch job, or monitoring agent. If you cannot explain the process tree, the file write, and the network destination together, escalate the host as compromised.
What good looks like: A defensible hunting workflow ties IIS, authentication, endpoint, and network telemetry to a single host timeline, then either clears the server or produces evidence of post-exploitation activity that justifies containment.
Practitioner takeaway: The most reliable ZeroT detection strategy is not searching for one signature, but proving whether the Exchange server’s behaviour still fits its expected operational role.