Privilege Escalation via Microsoft Exchange DLL Hijacking

Identifies attempts to load a DLL from a hardcoded path by the Microsoft Exchange IIS worker process (w3wp). This may indicate an attempt to elevate privilege via loading a malicious DLL from a path writable by low-privileged users.