Windows Process Creation: Exchange PowerShell Snap-in Loading via Add-PSSnapin
Flags PowerShell executions that Add-PSSnapin Exchange snap-ins, consistent with Exchange mailbox/config data collection.
- Product
- windows
- Category
- process_creation
- Author
- FPT.EagleEye, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-03-03
- Updated
- 2026-07-30
ATT&CK techniques
Execution → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies PowerShell or pwsh process execution where the command line includes Add-PSSnapin and targets Exchange PowerShell snap-in modules. Attackers may use snap-ins to interact with Exchange functionality for mailbox or configuration data collection. Telemetry relies on Windows process creation events capturing the image name and command line, including optional checks to exclude an msiexec parent process scenario.
Reporting behind it
- volexity.comhttps://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
- microsoft.comhttps://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
- intrinsec.comhttps://www.intrinsec.com/apt27-analysis/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_snapins_hafnium.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Exchange PowerShell Snap-in Loading via Add-PSSnapin"
id: b038aebf-4393-4175-a775-1831218c50a8
status: test
description: This rule identifies PowerShell or pwsh process execution where the command line includes Add-PSSnapin and targets Exchange PowerShell snap-in modules. Attackers may use snap-ins to interact with Exchange functionality for mailbox or configuration data collection. Telemetry relies on Windows process creation events capturing the image name and command line, including optional checks to exclude an msiexec parent process scenario.
references:
- https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
- https://www.intrinsec.com/apt27-analysis/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_snapins_hafnium.yml
author: FPT.EagleEye, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-03-03
modified: 2023-03-24
tags:
- attack.execution
- attack.t1059.001
- attack.collection
- attack.t1114
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \powershell.exe
- \pwsh.exe
- OriginalFileName:
- PowerShell.EXE
- pwsh.dll
selection_cli:
CommandLine|contains: Add-PSSnapin
selection_module:
CommandLine|contains:
- Microsoft.Exchange.Powershell.Snapin
- Microsoft.Exchange.Management.PowerShell.SnapIn
filter_msiexec:
ParentImage: C:\Windows\System32\msiexec.exe
CommandLine|contains: $exserver=Get-ExchangeServer ([Environment]::MachineName) -ErrorVariable exerr 2> $null
condition: all of selection_* and not 1 of filter_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 25676e10-2121-446e-80a4-71ff8506af47
type: derived