PowerShell Loading Exchange Management Snap-In
Detects the explicit loading of the Exchange Management snap-in by PowerShell, often a precursor to mailbox exfiltration as seen in SHADOW-EARTH-053 activity. This activity can indicate an adversary is preparing to interact with Exchange mailboxes.
Microsoft Sentinel (KQL)
