Windows Process Creation: Exchange PowerShell Snap-in Loading via Add-PSSnapin

title: "Windows Process Creation: Exchange PowerShell Snap-in Loading via Add-PSSnapin"
id: b038aebf-4393-4175-a775-1831218c50a8
status: test
description: This rule identifies PowerShell or pwsh process execution where the command line includes Add-PSSnapin and targets Exchange PowerShell snap-in modules. Attackers may use snap-ins to interact with Exchange functionality for mailbox or configuration data collection. Telemetry relies on Windows process creation events capturing the image name and command line, including optional checks to exclude an msiexec parent process scenario.
references:
  - https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
  - https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
  - https://www.intrinsec.com/apt27-analysis/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_snapins_hafnium.yml
author: FPT.EagleEye, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-03-03
modified: 2023-03-24
tags:
  - attack.execution
  - attack.t1059.001
  - attack.collection
  - attack.t1114
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
  selection_cli:
    CommandLine|contains: Add-PSSnapin
  selection_module:
    CommandLine|contains:
      - Microsoft.Exchange.Powershell.Snapin
      - Microsoft.Exchange.Management.PowerShell.SnapIn
  filter_msiexec:
    ParentImage: C:\Windows\System32\msiexec.exe
    CommandLine|contains: $exserver=Get-ExchangeServer ([Environment]::MachineName) -ErrorVariable exerr 2> $null
  condition: all of selection_* and not 1 of filter_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 25676e10-2121-446e-80a4-71ff8506af47
    type: derived