Exchange Management: Removal of Mailbox Export Request via Remove-MailboxExportRequest
Detects Exchange management removals of mailbox export requests using Remove-MailboxExportRequest with Confirm set to "False".
- Product
- windows
- Service
- msexchange-management
- Author
- Christian Burkard (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-08-27
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Exchange Management activity where a mailbox export request is removed using the Remove-MailboxExportRequest command with an identity parameter and confirmation set to false. Attackers can use mailbox export workflows to stage or move data and may remove export requests afterward to reduce evidence. It relies on service telemetry from the Exchange management interface capturing the specific command string and its parameters.
Reporting behind it
- github.comhttps://github.com/rapid7/metasploit-framework/blob/1416b5776d963f21b7b5b45d19f3e961201e0aed/modules/exploits/windows/http/exchange_proxyshell_rce.rb#L430
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/msexchange/win_exchange_proxyshell_remove_mailbox_export.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Exchange Management: Removal of Mailbox Export Request via Remove-MailboxExportRequest"
id: 446c2186-ff37-4dcf-8c49-0cd0a6a7d2e0
status: test
description: This rule flags Exchange Management activity where a mailbox export request is removed using the Remove-MailboxExportRequest command with an identity parameter and confirmation set to false. Attackers can use mailbox export workflows to stage or move data and may remove export requests afterward to reduce evidence. It relies on service telemetry from the Exchange management interface capturing the specific command string and its parameters.
references:
- https://github.com/rapid7/metasploit-framework/blob/1416b5776d963f21b7b5b45d19f3e961201e0aed/modules/exploits/windows/http/exchange_proxyshell_rce.rb#L430
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/msexchange/win_exchange_proxyshell_remove_mailbox_export.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-27
modified: 2023-01-23
tags:
- attack.stealth
- attack.t1070
logsource:
service: msexchange-management
product: windows
detection:
keywords:
"|all":
- Remove-MailboxExportRequest
- " -Identity "
- ' -Confirm "False"'
condition: keywords
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 09570ae5-889e-43ea-aac0-0e1221fb3d95
type: derived