Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell

Read More

Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log

Read More

Detects a failed installation of a Exchange Transport Agent

Read More

Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it

Read More

Detects the Installation of a Exchange Transport Agent

Read More

Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set-OabVirtualDirectory

Read More

Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit

Read More