Email Account List Enumerated via Exchange Web Services
This rule detects attempts to enumerate email accounts using Exchange Web Services (EWS). It specifically looks for HTTP requests to the '/EWS/Exchange.asmx' URI containing the 'FindItem' content in the client body. A threshold of 10 such requests within 30 seconds from the same source IP triggers the alert, indicating a potential network scan or discovery activity targeting email accounts.
Suricata
