Detection rules › By event

MSExchange-CmdletLogs

Event	Rules
Event ID 1	2
Event ID 6	3
Event ID 8	1

Event ID 1

2 detection rules reference this event. View event page.

Sigma (1)

Exchange transport agent installation artifacts (native) severity high T1505, T1505.002

Splunk (1)

Windows MSExchange Management Mailbox Cmdlet Usage severity low T1059, T1059.001

Event ID 6

3 detection rules reference this event. View event page.

Sigma (3)

Exchange transport agent installation artifacts (native) severity high T1505, T1505.002
Failed MSExchange Transport Agent Installation severity high T1505, T1505.002
Possible Exploitation of Exchange RCE CVE-2021-42321 severity high T1210

Event ID 8

1 detection rules reference this event. View event page.

Sigma (1)

Possible Exploitation of Exchange RCE CVE-2021-42321 severity high T1210