("cs-method":POST "sc-status":200 ("cs-uri-query":\/owa\/* "cs-uri-query":\/powershell*) ("cs-uri-query":@* OR "cs-uri-query":%40*)) (-("cs-user-agent":ClientInfo OR "cs-user-agent":Microsoft\ WinRM\ Client OR "cs-user-agent":Exchange\ BackEnd\ Probes))