- Detects potential malware with libyara.NET (we use our own build with different fixes).
- Extracts archives with SevenZipSharp.
- Disarms potentially malicious PDFs with based on xdpdf algorithm.
- Parses subject/body/headers with regex, aho-corasik.
- Checks MessageId and source subnet of messages.
- Can send user email notifications about potentially malicious messages.
- Marks potentially malicious message with special header, which helps you archive and reject malicious messages on your Exchange server.
- Uses metrics to decide whether a message is malicious.
- Bruteforces archive attachments with the dictionary generated on message text (bad guys like that way to hide malicious files from antiviruses).
Using third party libraries:
- https://github.com/pdonald/aho-corasick
- https://github.com/braktech/xdpdf
- https://github.com/squid-box/SevenZipSharp
- https://github.com/microsoft/libyara.NET
- https://logging.apache.org/log4net/
- https://github.com/gdziadkiewicz/log4net.Ext.Json
- https://github.com/lduchosal/ipnetwork
- https://github.com/zzzprojects/html-agility-pack
Linyaranet requires .Net version 4.6 and higher. You can check if your server support it:
- Check your exchange server version https://docs.microsoft.com/en-us/exchange/new-features/build-numbers-and-release-dates?view=exchserver-2019
- Check if it support .Net v4.6 or higher https://docs.microsoft.com/en-us/exchange/plan-and-deploy/supportability-matrix?view=exchserver-2019
- Stop-Service msexchangetransport
- ls "c:\Path\To\FilterBinaries" -Recurse | Unblock-File
- Install-TransportAgent -Name "ExchangeFilter" -TransportAgentFactory "ExchangeFilterAgentFactory " -AssemblyPath "c:\Path\To\FilterBinaries\ExchangeFilter.dll"
- Set-TransportAgent "ExchangeFilter" -Priority 10
- Enable-TransportAgent -identity ExchangeFilter
- Start-Service msexchangetransport
- Config.cs - Class contains necessary configurations, without which agents work is impossible.
- default_config.xml - once configured, will be backup fuse, and if you change config.xml with mistake, agent will use default configuration
- config.xml - main configuration file.
Information about messages processing is stored as JSON on filesystem via log4net.Ext.Json. Its useful to process these logs via ELK stack.