Remove Exported Mailbox from Exchange Webserver — Detection Rule

Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit

Read the full analysis on IntelFusions