PHP process or web server connecting to Exchange Web Services (EWS) endpoint

ills3c Intel&Coffee@Ills3C

•updated 5 days ago•1•0•5

Detects PHP script execution interacting with the Microsoft Exchange Web Services (EWS) API, which may indicate web shell usage, email collection, or exfiltration activity.