Windows Exchange PowerShell Cmdlet History Log Files Deleted

Flags deletion of Exchange PowerShell cmdlet history log files in the expected logging directory.

FreeUnreviewedSigmahighv1

windows-exchange-powershell-cmdlet-history-log-files-deleted-a55349d8

title: Windows Exchange PowerShell Cmdlet History Log Files Deleted
id: e9a31e9d-0788-48de-a229-3edbea310f62
status: test
description: This rule detects deletion of Exchange PowerShell cmdlet history log files based on targeted filename paths and naming patterns. Attackers may delete these logs to reduce available forensic artifacts and hinder incident investigation. It relies on file deletion telemetry that records the deleted filename, matching paths under the PowerShell cmdlet logging directory that include the expected cmdlet identifier substring.
references:
  - https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_delete_exchange_powershell_logs.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-26
modified: 2022-12-30
tags:
  - attack.stealth
  - attack.t1070
logsource:
  category: file_delete
  product: windows
detection:
  selection:
    TargetFilename|startswith: \Logging\CmdletInfra\LocalPowerShell\Cmdlet\
    TargetFilename|contains: _Cmdlet_
  condition: selection
falsepositives:
  - Possible FP during log rotation
level: high
license: DRL-1.1
related:
  - id: a55349d8-9588-4c5a-8e3b-1925fe2a4ffe
    type: derived

What it detects

This rule detects deletion of Exchange PowerShell cmdlet history log files based on targeted filename paths and naming patterns. Attackers may delete these logs to reduce available forensic artifacts and hinder incident investigation. It relies on file deletion telemetry that records the deleted filename, matching paths under the PowerShell cmdlet logging directory that include the expected cmdlet identifier substring.

Known false positives

Possible FP during log rotation

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.