Threat Intel Accelerates Detection and Response

This Huntress report details discovery of reconnaissance activity against a legacy MSExchange installation: the attacker used OWA/powershell endpoints to execute commands (finger.exe, encoded PowerShell, whoami) that contacted IP 185.56.83.82. Huntress correlated Windows Defender detections, MSExchange CmdletLogs, and IIS logs to validate the indicators of compromise, mapped the behavior to OWASSRF exploitation, and advised immediate Exchange patching.