Certificate Request Export to Exchange Webserver

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell