Suspicious MSExchangeMailboxReplication ASPX Write

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•29

Detects suspicious activity where the MSExchangeMailboxReplication process writes .asp or .aspx files to disk. This behavior is often indicative of web shell deployment, potentially following an exploit like ProxyShell, to establish persistence or further access.