huntrule

PowerShell Email Address Exfiltration via EXIF-style Recipient Harvesting on Windows

Alerts when PowerShell command lines enumerate Exchange recipients and expand email address properties, indicating potential email data exfiltration.

FreeUnreviewedSigmahighv1
title: PowerShell Email Address Exfiltration via EXIF-style Recipient Harvesting on Windows
id: fa94b60c-b5ad-48bf-ac92-d4a2d4bef8b9
status: test
description: This rule flags Windows process executions of PowerShell (powershell.exe or pwsh.exe) whose command lines include Exchange/SMTP recipient harvesting and email-address expansion patterns. Attackers commonly use PowerShell to enumerate recipient data and package it for unauthorized email collection and exfiltration. The detection relies on Windows process creation telemetry, matching the PowerShell binary and specific command-line fragments such as Add-PSSnapin, Get-Recipient, and properties related to EmailAddresses and SmtpAddress.
references:
  - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
  - https://github.com/Azure/Azure-Sentinel/blob/7e6aa438e254d468feec061618a7877aa528ee9f/Hunting%20Queries/Microsoft%20365%20Defender/Ransomware/DEV-0270/Email%20data%20exfiltration%20via%20PowerShell.yaml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_email_exfil.yml
author: Nasreddine Bencherchali (Nextron Systems),  Azure-Sentinel (idea), Huntrule Team
date: 2022-09-09
tags:
  - attack.exfiltration
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
    CommandLine|contains|all:
      - Add-PSSnapin
      - Get-Recipient
      - -ExpandProperty
      - EmailAddresses
      - SmtpAddress
      - -hidetableheaders
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 312d0384-401c-4b8b-abdf-685ffba9a332
    type: derived

What it detects

This rule flags Windows process executions of PowerShell (powershell.exe or pwsh.exe) whose command lines include Exchange/SMTP recipient harvesting and email-address expansion patterns. Attackers commonly use PowerShell to enumerate recipient data and package it for unauthorized email collection and exfiltration. The detection relies on Windows process creation telemetry, matching the PowerShell binary and specific command-line fragments such as Add-PSSnapin, Get-Recipient, and properties related to EmailAddresses and SmtpAddress.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.