During the Proxlogon event it talks about, I wrote the following for this scenario: https://github.com/technion/IISBackdoorDetect/blob/main/IISBackdoorDetect.p

During the Proxlogon event it talks about, I wrote the following for this scenario: https://github.com/technion/IISBackdoorDetect/blob/main/IISBackdoorDetect.ps1 https://github.com/technion/IISBackdoorDetect/blob/main/IISB... I still run it routinely on all our managed Exchange servers.