"cs-uri-query":\/autodiscover.json* ("cs-uri-query":\/powershell* OR "cs-uri-query":\/mapi\/nspi* OR "cs-uri-query":\/EWS* OR "cs-uri-query":X\-Rps\-CAT*) ("sc-status":200 OR "sc-status":301)