Detectioncriticaltest

Suspicious PowerShell Mailbox Export to Share

Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems)Created Sat Aug 07Updated Wed Oct 26889719ef-dd62-43df-86c3-768fb08dc7c0windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        CommandLine|contains|all:
            - 'New-MailboxExportRequest'
            - ' -Mailbox '
            - ' -FilePath \\\\'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0010 · Exfiltration

Rule Metadata

Rule ID

889719ef-dd62-43df-86c3-768fb08dc7c0

Status

test

Level

critical

Type

Detection

Created

Sat Aug 07

Modified

Wed Oct 26

Author

Florian Roth (Nextron Systems)

Path

rules/windows/process_creation/proc_creation_win_powershell_mailboxexport_share.yml

Raw Tags

attack.exfiltration

View on GitHub