Exchange Management: Remove-MailboxExportRequest Triggered With Confirm False

title: "Exchange Management: Remove-MailboxExportRequest Triggered With Confirm False"
id: 446c2186-ff37-4dcf-8c49-0cd0a6a7d2e0
status: test
description: This rule flags Exchange management activity where a mailbox export request is removed using the Remove-MailboxExportRequest command with Confirm set to "False". Removing export requests can be used to reduce evidence of mailbox export activity after unauthorized access attempts. The detection relies on service telemetry from the Exchange management interface and matches the presence of the specific command text and parameter pattern in logged events.
references:
  - https://github.com/rapid7/metasploit-framework/blob/1416b5776d963f21b7b5b45d19f3e961201e0aed/modules/exploits/windows/http/exchange_proxyshell_rce.rb#L430
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/msexchange/win_exchange_proxyshell_remove_mailbox_export.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-27
modified: 2023-01-23
tags:
  - attack.stealth
  - attack.t1070
logsource:
  service: msexchange-management
  product: windows
detection:
  keywords:
    "|all":
      - Remove-MailboxExportRequest
      - " -Identity "
      - ' -Confirm "False"'
  condition: keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 09570ae5-889e-43ea-aac0-0e1221fb3d95
    type: derived