A week earlier, GTSC had published the Exchange zero-days it saw exploited in the wild, CVE-2022-41040 and CVE-2022-41082.
The initial mitigation provided by Microsoft was quickly bypassed by Janggggg.
So Microsoft had to update the mitigations.
Then, Kevin Beaumont found another bypass.
The problem was that Microsoft Exchange replaces .. with @.
Consequently, Microsoft had to update the mitigations again.
The next bypass was based on URL encoding, e.g., P encoded as %50.
The utilized mitigation did not take this into account.
Then, the next bypass abused the fact that Exchange accepted anything if autodiscover.json was at the end.
Consequently, Microsoft had to update the mitigation once again.
At the end of the week, the mitigations change quite a lot from
.*autodiscover\.json.*\@.*Powershell.*
to
(?=.*autodiscover)(?=.*powershell)
DoublePulsar has a good summary of the fiasco.