Detection rules › By catalog entry

MSExchange-CmdletLogs

Catalog entry	Rules
Event ID 1	2
Event ID 6	3
Event ID 8	1

Event ID 1

2 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

Exchange transport agent installation artifacts (native) severity high T1505,T1505.002

Splunk (1)

Windows MSExchange Management Mailbox Cmdlet Usage severity low T1059,T1059.001

Event ID 6

3 detection rules reference this catalog entry. View catalog entry.

Sigma (3)

Exchange transport agent installation artifacts (native) severity high T1505,T1505.002
Failed MSExchange Transport Agent Installation severity high T1505,T1505.002
Possible Exploitation of Exchange RCE CVE-2021-42321 severity high T1210

Event ID 8

1 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

Possible Exploitation of Exchange RCE CVE-2021-42321 severity high T1210

Back to all MSExchange-CmdletLogs catalog entries