## Overview

Post detection of **Web Shell Deployment**, an investigation revealed the presence of multiple malicious web shells on the Exchange server.

## Indicators of Compromise
- **File Path**: `/owa/auth/xyz.aspx`
- **File Size**: 3kb
- **Behavior**: Command execution via PowerShell

## Recommendations
- Conduct a thorough scan for additional web shells.
- Isolate the affected server to prevent further compromise.

## Next Steps
Monitor for privilege escalation attempts, particularly those exploiting CVE-2021-34523.