A few things from the @Volexity blog to highlight - if you're concerned about being impacted by Dark Halo (who used #SolarWindsOrion for access), it's probably worth a look at your Exchange servers. Check for weirdness in \\Microsoft\\Exchange Server\\V15\\FrontEnd\\HttpProxy\\owa\\auth

Might also be worth checking for what devices can do an active sync - my read on this is that this allows adversaries to copy victim mailboxes to their devices. I'm thinking of this in the same vein as checking for email forwarding rules.

Yes, the adversaries cleaned up, but I think it's still worth a check. If you sent PowerShell logs from your Exchange server anywhere, those would make for some great hunts. Lots of ideas in the excellent blog. https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/