sigma/file_event_win_exchange_webshell_drop_suspicious.yml at master · SigmaHQ/sigma · GitHub

https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/file_event_win_exchange_webshell_drop_suspicious.yml