Webshell Posts
Query
//Looking for suspicious posts
W3CIISLog
| where csUriStem == "/autodiscover/autodiscover.json"
| where csUriQuery has "PowerShell" | where csMethod == "POST"Explanation
This query is searching for suspicious posts in the W3CIISLog. It filters the logs to find entries where the csUriStem is "/autodiscover/autodiscover.json", the csUriQuery contains the word "PowerShell", and the csMethod is "POST".