Since Exchange depends on Internet Information Services (IIS) webserver, an attacker can write ASPX webshells and run arbitrary commands as SYSTEM on the Exchange Server.  In January 2021, we came across extensive use of Chopper ASPX webshells in targeted attacks by malicious actors to establish persistence and a foothold on the public-facing Outlook Web App servers.   Trend Micro Cloud One™ – Workload Security Correlation: