The attacker abuses the Autodiscover SSRF to reach the backend PowerShell endpoint, then writes an ASPX webshell to a known Exchange path for persistence and RCE.

Hunt for new .aspx files in Exchange virtual directories, suspicious /autodiscover/autodiscover.json?...&Email=autodiscover requests in IIS logs, and w3wp.exe spawning cmd/powershell.

Patch Exchange to the latest CU/SU, review IIS logs and webroots for shells, and restrict external access to Exchange management endpoints.

The attacker sends a crafted request to the Exchange front end (SSRF) to authenticate as the server to the backend, then chains write primitives to drop an ASPX webshell.

Hunt for POSTs to /owa/auth/ or ecp/ with anomalous cookies in IIS logs, new .aspx files in Exchange virtual directories, and w3wp.exe spawning cmd/powershell.

Apply Exchange security updates immediately, run Microsoft's mitigation/scanner scripts, and hunt webroots + IIS logs for shells and IOCs.

The attacker sends an appointment with PidLidReminderFileParameter pointing to a UNC path on their server; Outlook connects on reminder, leaking the NTLM hash to relay or crack.

Hunt for outbound SMB (445) to external/unknown hosts from user workstations, and use Microsoft's script to scan mailboxes for malicious reminder properties.

Patch Outlook, block outbound SMB to the internet, add users to Protected Users / enforce SMB signing, and run the mailbox-scanning script.