SEKOIA.IO Rules high stable sigma

Exchange PowerShell Snap-Ins To Export Exchange Mailbox Data

Detects PowerShell SnapIn command line, often used with Get-Mailbox to export Exchange mailbox data.

View Source

Detection Logic

process:
  process.command_line
| contains: Microsoft.Exchange.Management.Powershell.Snapin
scriptblocktext:
  action.properties.ScriptBlockText
| re: (?i).*Add-PSSnapin\s+Microsoft\.Exchange\.Management\.Powershell\.Snapin.+Get-Mailbox.*
condition: process or scriptblocktext

Field Validations

Loading…

Comments (0)

Loading comments...