Suspicious PowerShell Mailbox Export to Share
Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations
Sigma rule (View on GitHub)
1title: Suspicious PowerShell Mailbox Export to Share
2id: 889719ef-dd62-43df-86c3-768fb08dc7c0
3status: test
4description: Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations
5references:
6 - https://youtu.be/5mqid-7zp8k?t=2481
7 - https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
8 - https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1
9 - https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/
10author: Florian Roth (Nextron Systems)
11date: 2021-08-07
12modified: 2022-10-26
13tags:
14 - attack.exfiltration
15logsource:
16 category: process_creation
17 product: windows
18detection:
19 selection:
20 CommandLine|contains|all:
21 - 'New-MailboxExportRequest'
22 - ' -Mailbox '
23 - ' -FilePath \\\\'
24 condition: selection
25fields:
26 - CommandLine
27 - ParentCommandLine
28falsepositives:
29 - Unknown
30level: critical
References
-
This will be a high-level summary of the different logs that can be found on an On-Premises Exchange server, which can be useful during an IR. For each log, I’ll try to explain what we can ac…
Read More
Related rules
- APT40 Dropbox Tool User Agent
- AWS EC2 VM Export Failure
- AWS RDS Master Password Change
- AWS S3 Data Management Tampering
- AWS Snapshot Backup Exfiltration