PowerShell Email Address Exfiltration via EXIF-style Recipient Harvesting on Windows
Alerts when PowerShell command lines enumerate Exchange recipients and expand email address properties, indicating potential email data exfiltration.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), Azure-Sentinel (idea) (SigmaHQ), DRL 1.1
- Published
- 2022-09-09
- Updated
- 2026-07-30
What it detects
This rule flags Windows process executions of PowerShell (powershell.exe or pwsh.exe) whose command lines include Exchange/SMTP recipient harvesting and email-address expansion patterns. Attackers commonly use PowerShell to enumerate recipient data and package it for unauthorized email collection and exfiltration. The detection relies on Windows process creation telemetry, matching the PowerShell binary and specific command-line fragments such as Add-PSSnapin, Get-Recipient, and properties related to EmailAddresses and SmtpAddress.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
- github.comhttps://github.com/Azure/Azure-Sentinel/blob/7e6aa438e254d468feec061618a7877aa528ee9f/Hunting%20Queries/Microsoft%20365%20Defender/Ransomware/DEV-0270/Email%20data%20exfiltration%20via%20PowerShell.yaml
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_email_exfil.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell Email Address Exfiltration via EXIF-style Recipient Harvesting on Windows
id: fa94b60c-b5ad-48bf-ac92-d4a2d4bef8b9
status: test
description: This rule flags Windows process executions of PowerShell (powershell.exe or pwsh.exe) whose command lines include Exchange/SMTP recipient harvesting and email-address expansion patterns. Attackers commonly use PowerShell to enumerate recipient data and package it for unauthorized email collection and exfiltration. The detection relies on Windows process creation telemetry, matching the PowerShell binary and specific command-line fragments such as Add-PSSnapin, Get-Recipient, and properties related to EmailAddresses and SmtpAddress.
references:
- https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
- https://github.com/Azure/Azure-Sentinel/blob/7e6aa438e254d468feec061618a7877aa528ee9f/Hunting%20Queries/Microsoft%20365%20Defender/Ransomware/DEV-0270/Email%20data%20exfiltration%20via%20PowerShell.yaml
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_email_exfil.yml
author: Nasreddine Bencherchali (Nextron Systems), Azure-Sentinel (idea), Huntrule Team
date: 2022-09-09
tags:
- attack.exfiltration
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \powershell.exe
- \pwsh.exe
CommandLine|contains|all:
- Add-PSSnapin
- Get-Recipient
- -ExpandProperty
- EmailAddresses
- SmtpAddress
- -hidetableheaders
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 312d0384-401c-4b8b-abdf-685ffba9a332
type: derived