Exchange PowerShell Cmdlet History Deleted
Detects the deletion of Exchange PowerShell cmdlet history logs, which may indicate an attempt by an adversary to destroy forensic evidence and evade detection. This action can hinder incident response and forensic analysis.
Sigma
