Elastic medium stable kql

Exchange Mailbox Export via PowerShell

Detects PowerShell script block content that creates Exchange mailbox export requests via New-MailboxExportRequest, commonly writing PST files. Adversaries can abuse export requests to collect and stage email content for exfiltration.

View Source

Detection Logic

event.category:process and host.os.type:windows and
powershell.file.script_block_text : "New-MailboxExportRequest" and
(
  powershell.file.script_block_text : ("-FilePath" or ".pst") and
  powershell.file.script_block_text : ("-Mailbox" or "Get-Mailbox" or "ExportToPSTFile" or "-Identity")
)

False Positives

⚠ Legitimate exchange system administration activity.

Field Validations

Loading…

Comments (0)

Loading comments...