Sigma rule that monitors suspicious file creations on Exchange servers by the IIS server process

Sigma rules:

[sigma/file\_event\_win\_exchange\_webshell\_drop\_suspicious.yml at master · SigmaHQ/sigma · GitHub](https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/file_event_win_exchange_webshell_drop_suspicious.yml)

Sysmon:

[sysmon-config/sysmonconfig-export.xml at master · Neo23x0/sysmon-config · GitHub](https://github.com/Neo23x0/sysmon-config/blob/master/sysmonconfig-export.xml)

blueteamsec exchange iis process server servers sigma