Exchange Recent Created Users Script - CVE-2021-27065

Quick script to check for added users after compromise from the latest Exchange 0Day - CVE-2021-27065
(change 7 to however many days ago you got popped/shells appeared)

$compdate=(get-date).adddays(-7)
Get-ADUser -filter * -property whenCreated | where {$_.whenCreated -gt $compdate} | ft Name, whenCreated -Autosize