Remove Exported Mailbox from Exchange Webserver — Detection Rule
Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit
Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit