Microsoft Exchange PowerShell: Mailbox export to UNC path with .aspx or role assignment

Flags Exchange mailbox export commands targeting UNC paths with .aspx or granting the Mailbox Import Export role.

FreeUnreviewedSigmacriticalv1

microsoft-exchange-powershell-mailbox-export-to-unc-path-with-aspx-or-role-assig-516376b4

title: "Microsoft Exchange PowerShell: Mailbox export to UNC path with .aspx or role assignment"
id: 9c331ef7-db9e-4d4a-8776-acafc7bb278a
status: test
description: This rule matches Exchange Management shell commands that create a mailbox export request writing to a network share path with an .aspx suffix, or that assign the 'Mailbox Import Export' management role to a user. Attackers can use mailbox export to write web-accessible files or to grant the required permissions for subsequent import/export activity. The detection relies on Exchange management telemetry capturing successful command strings for New-MailboxExportRequest, New-ManagementRoleAssignment, and their relevant parameters.
references:
  - https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/msexchange/win_exchange_proxyshell_mailbox_export.yml
author: Florian Roth (Nextron Systems), Rich Warren, Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-09
modified: 2023-04-30
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  service: msexchange-management
  product: windows
detection:
  export_command:
    "|all":
      - New-MailboxExportRequest
      - " -Mailbox "
  export_params:
    - -FilePath "\\\\
    - .aspx
  role_assignment:
    "|all":
      - New-ManagementRoleAssignment
      - ' -Role "Mailbox Import Export"'
      - " -User "
  condition: (export_command and export_params) or role_assignment
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 516376b4-05cd-4122-bae0-ad7641c38d48
    type: derived

What it detects

This rule matches Exchange Management shell commands that create a mailbox export request writing to a network share path with an .aspx suffix, or that assign the 'Mailbox Import Export' management role to a user. Attackers can use mailbox export to write web-accessible files or to grant the required permissions for subsequent import/export activity. The detection relies on Exchange management telemetry capturing successful command strings for New-MailboxExportRequest, New-ManagementRoleAssignment, and their relevant parameters.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.