What are the signs that Exchange zero-day exploitation may already be happening?

How Exchange zero-day exploitation presents in the environment

The strongest signals are often combinations of access, file, and network anomalies that do not fit normal administrator activity. Exchange is a high-value perimeter service, so a zero-day is usually visible first through post-exploitation behavior rather than through the exploit itself. The practical question is whether the server has begun acting like a beachhead for adversary tradecraft instead of a mail platform.

That is why investigators should treat remote management access, unexpected web content, and abnormal outbound connections as a correlated set. One noisy indicator on its own may be benign, but several together can show that an attacker has moved from initial access into command execution, persistence, or staging. On systems that were internet-facing before the event, the threshold for concern should be especially low.

In practice, the signs usually cluster around three places: administrative channels, the Exchange web root, and outbound telemetry. Remote PowerShell activity on ports 5985 or 5986 is concerning when it appears from unusual source addresses, at unusual times, or in volumes that exceed normal operations. Suspicious ASPX files, modified pages, or new webshells in Exchange directories are stronger indicators because they suggest server-side code execution and persistence. Unexpected traffic to command-and-control infrastructure, especially when paired with data transfer spikes, often means the host is already participating in follow-on attacker activity.

What the signs usually mean for attacker behavior

These indicators matter because they often reflect the step after exploitation, not the exploit itself. Once an Exchange server is compromised, attackers frequently use it to establish an interactive foothold, collect credentials, deploy a webshell, or move data out of the environment. That means the most useful interpretation is behavioral: what changed on the host that would not normally happen during routine mail administration?

A webshell can indicate persistence because it gives the attacker a reusable server-side execution path. Remote PowerShell activity can indicate remote administration abuse, post-exploitation tooling, or lateral movement preparation. Outbound traffic to unfamiliar hosts can indicate staging, command retrieval, or exfiltration. The same server may also begin producing unusual authentication, process, or file-write patterns that align with those actions. For a public-facing Exchange instance, these are not isolated anomalies, they are often a sequence.

Because the platform is both exposed and operationally sensitive, compromise can be difficult to distinguish from legitimate maintenance unless teams know their normal baselines. That is why the strongest judgment is not “is there one suspicious event?” but “does the chain of events fit an attacker workflow?” The more the answer resembles a coordinated chain, the more likely exploitation is already underway.

How to separate routine Exchange activity from compromise signals

Good triage starts by comparing the suspicious activity with normal admin patterns, patch windows, and service account behavior. If remote PowerShell, IIS file changes, or outbound connections occur outside those windows, treat them as higher priority. If the server is generating artifacts that do not belong to Exchange operations, such as new ASPX files or altered web directories, assume the host needs deeper inspection rather than light validation.

Investigators should also correlate host evidence with network and identity evidence. A single source IP repeatedly hitting management ports, unusual parent-child process trees, or a sudden burst of outbound sessions can reinforce the case for active exploitation. Likewise, if the server was previously reachable from the public internet and then begins showing file or network changes, the likelihood of attacker follow-through rises quickly. The important judgment is whether the evidence fits a one-off anomaly or a durable post-exploitation presence.

For broader context on exploitation patterns, the CISA Known Exploited Vulnerabilities Catalog is useful for prioritization when a specific Exchange flaw becomes confirmed active exploitation, while the NIST National Vulnerability Database helps map the affected product and vulnerability details. When defenders need to estimate whether public chatter is turning into real-world exploitation, FIRST EPSS provides an additional prioritization signal rather than proof of compromise.

Risk and Threat Considerations

Exchange zero-day exploitation is high risk because the platform often sits at a trust boundary and has privileged access to mail, authentication flows, and internal communication. When compromise occurs, attackers can use the server as a durable foothold, a staging point for deeper intrusion, or a data-exfiltration node, which makes early detection materially important.

Failure mechanism: The attacker abuses an unpatched or unknown flaw to gain code execution, then leaves behind a webshell, remote management abuse path, or outbound beaconing that blends into normal Exchange operations.

Impact: The result can be persistence, credential theft, lateral movement, mailbox access, and data exfiltration, often before defenders fully understand the initial entry point.

Practitioner Guidance

What to prioritize: Treat the combination of remote PowerShell on 5985 or 5986, new ASPX or webshell artifacts, and unusual outbound traffic as a single incident until proven otherwise. Correlation is more important than any one indicator, because zero-day activity often looks fragmented at first.

What to verify: Confirm whether the observed activity lines up with approved administration windows, known patching work, and expected server roles. If you cannot quickly explain the source host, the file change, and the outbound destination, escalate to incident response rather than continuing routine troubleshooting.

Practitioner takeaway: For Exchange, the question is rarely whether the server was probed, it is whether it is already being used as an attacker-controlled foothold. Assume compromise when the host begins behaving like an intermediary for remote execution and data movement.

Related resources from NHI Mgmt Group

• What are the signs that a gateway zero-day may already be under active exploitation?
• What are the early signs that AWS IAM role exploitation is already happening?
• What are the signs that a SharePoint zero-day exploitation campaign is succeeding?
• How should security teams protect Exchange Server admin access against credential abuse during zero-day exploitation?