Mailbox Export to Exchange Webserver

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•1

Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it