Sigma rule: Suspicious PowerShell Mailbox Export to Share - PS
A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-d812859e13d5, updated 2022-10-26T00:00:00.000Z.
Rule
- Title
- Suspicious PowerShell Mailbox Export to Share - PS
- Status
- test
- Level
- critical
- Author
- Nasreddine Bencherchali (Nextron Systems)
- Date
- 2022-10-26
- File
- rules/windows/powershell/powershell_script/posh_ps_mailboxexport_share.yml
- Commit
- ccbb0369507f796db0b0ae6854c8a2be471b9d84
Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations
Log source
- product
- windows
- category
- ps_script
- definition
- Requirements: Script Block Logging must be enabled
Detection
selection:
ScriptBlockText|contains|all:
- 'New-MailboxExportRequest'
- ' -Mailbox '
- ' -FilePath \\\\'
condition: selectionFalse positives (as the rule lists them)
- Unknown
Tags
- attack.exfiltration
Related rules
References
- https://youtu.be/5mqid-7zp8k?t=2481
- https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
- https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1
- https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/
Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/powershell/powershell_script/posh_ps_mailboxexport_share.yml
Sources and licences
SigmaHQ
"Suspicious PowerShell Mailbox Export to Share - PS" by Nasreddine Bencherchali (Nextron Systems) (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/powershell/powershell_script/posh_ps_mailboxexport_share.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Cite this page
Dragons Eye Ransomware Tracker, "Sigma rule: Suspicious PowerShell Mailbox Export to Share - PS",
entity page, dataset version ref-d812859e13d5, updated 2022-10-26T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/4a241dea-235b-4a7e-8d76-50d817b146c4 (accessed 2026-11-03).
Underlying source: SigmaHQ rule 4a241dea-235b-4a7e-8d76-50d817b146c4, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.
Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.