Below is a sequence of suspicious SOAP calls logged by AMSI when attackers attempt to exfiltrate emails. Figure 8. AMSI logs showing suspicious sequence of SOAP operations seen during remote mailbox ...