Sigma rule: Email Exifiltration Via Powershell

Rule

Title

Email Exifiltration Via Powershell

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems), Azure-Sentinel (idea)

Date

2022-09-09

File

rules/windows/process_creation/proc_creation_win_powershell_email_exfil.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects email exfiltration via powershell cmdlets

Log source

product

windows

category

process_creation

Detection

selection:
    Image|endswith:
        - '\powershell.exe'
        - '\pwsh.exe'
    CommandLine|contains|all:
        - 'Add-PSSnapin'
        - 'Get-Recipient'
        - '-ExpandProperty'
        - 'EmailAddresses'
        - 'SmtpAddress'
        - '-hidetableheaders'
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.exfiltration

References

• https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
• https://github.com/Azure/Azure-Sentinel/blob/7e6aa438e254d468feec061618a7877aa528ee9f/Hunting%20Queries/Microsoft%20365%20Defender/Ransomware/DEV-0270/Email%20data%20exfiltration%20via%20PowerShell.yaml

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_powershell_email_exfil.yml