An Exchange server was compromised with ransomware. Use Splunk to investigate how the attackers compromised the server.