Microsoft Exchange: Mailbox export to UNC path or .aspx filename with possible role assignment
Flags Exchange mailbox export commands targeting UNC paths with .aspx or granting the Mailbox Import Export role.
- Product
- windows
- Service
- msexchange-management
- Author
- Florian Roth (Nextron Systems), Rich Warren, Christian Burkard (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-08-09
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags successful use of Exchange management commands that export a mailbox to a network share using a FilePath ending in .aspx, which could be used to place executable web content. It also alerts when the command sequence assigns the "Mailbox Import Export" management role to a user, enabling mailbox export/import capabilities. The detection relies on telemetry from the msexchange-management service capturing command content, including New-MailboxExportRequest parameters and New-ManagementRoleAssignment arguments.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Microsoft Exchange: Mailbox export to UNC path or .aspx filename with possible role assignment"
id: 9c331ef7-db9e-4d4a-8776-acafc7bb278a
status: test
description: This rule flags successful use of Exchange management commands that export a mailbox to a network share using a FilePath ending in .aspx, which could be used to place executable web content. It also alerts when the command sequence assigns the "Mailbox Import Export" management role to a user, enabling mailbox export/import capabilities. The detection relies on telemetry from the msexchange-management service capturing command content, including New-MailboxExportRequest parameters and New-ManagementRoleAssignment arguments.
references:
- https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/msexchange/win_exchange_proxyshell_mailbox_export.yml
author: Florian Roth (Nextron Systems), Rich Warren, Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-09
modified: 2023-04-30
tags:
- attack.persistence
- attack.t1505.003
logsource:
service: msexchange-management
product: windows
detection:
export_command:
"|all":
- New-MailboxExportRequest
- " -Mailbox "
export_params:
- -FilePath "\\\\
- .aspx
role_assignment:
"|all":
- New-ManagementRoleAssignment
- ' -Role "Mailbox Import Export"'
- " -User "
condition: (export_command and export_params) or role_assignment
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: 516376b4-05cd-4122-bae0-ad7641c38d48
type: derived