PHP process or web server connecting to Exchange Web Services (EWS) endpoint

ills3c Intel&Coffee@Ills3C

•updated 13 days ago•2•0•8

Detects PHP script execution interacting with the Microsoft Exchange Web Services (EWS) API, which may indicate web shell usage, email collection, or exfiltration activity.