Mailbox Data Purged via Exchange Web Services

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to purge mailbox data using Exchange Web Services (EWS) by looking for HTTP requests to '/EWS/Exchange.asmx' containing the 'HardDelete' string in the client body. This activity is indicative of an attacker attempting to remove evidence or sensitive information from a compromised mailbox.