ProxyLogon MSExchange OabVirtualDirectory — Detection Rule

Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set-OabVirtualDirectory