Exchange Mailbox Export to Webserver or Role Assignment
Detects attempts to export an Exchange mailbox to an unusual file path, specifically to a network share or a file with an .aspx extension, which could indicate an adversary attempting to place a webshell. It also detects the assignment of the 'Mailbox Import Export' role to a user, a prerequisite for performing mailbox exports.
Sigma
