Explaining the change of heart, Microsoft said the processes no longer affect the stability, or the performance, of Exchange servers, adding that it could even be beneficial as some threat actors could have hidden backdoors in there, as well.
Some of the processes and folders include Temporary ASP.NET files, Inetsrv folders, as well as the PowerShell and w3wp processes.
Exclude no more
"Keeping these exclusions may prevent detections of IIS webshells and backdoor modules, which represent the most common security issues," the Exchange Team said. "We've validated that removing these processes and folders doesn't affect performance or stability when using Microsoft Defender on Exchange Server 2019 running the latest Exchange Server updates."
The new recommendations affect Exchange Server 2016 and Exchange Server 2013. However, Microsoft added that IT teams should monitor these processes just in case anything goes south.
Here’s a full list of no-longer-needed exclusions:
- %SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files
Threat actors had been observed using malicious Internet Information Services (IIS) web server extensions and modules, to add backdoors to unpatched Microsoft Exchange servers.
The best way to stay safe is to always apply the latest Exchange patches and updates, to use antivirus programs, restrict access to IIS virtual directories, prioritize alerts, and constantly inspect config files and bin folders for any suspicious files, the publication added.
Finally, IT teams should always run the Exchange Server Health Checker script after updates, to address any possible misconfiguration issues.
Exchange Servers are one of the most popular targets for cybercriminals worldwide, as they’re often unprotected, or misconfigured. At the same time, many offer a real treasure trove of sensitive information that can be sold on the black market, or used as leverage in a ransom negotiation.
- Check out the best endpoint protection right now
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.