Sigma rule: Mailbox Export to Exchange Webserver

Rule

Title

Mailbox Export to Exchange Webserver

Status

test

Level

critical

Author

Florian Roth (Nextron Systems), Rich Warren, Christian Burkard (Nextron Systems)

Date

2021-08-09

Modified

2023-04-30

File

rules/windows/builtin/msexchange/win_exchange_proxyshell_mailbox_export.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it

Log source

product

windows

service

msexchange-management

Detection

export_command:
    '|all':
        - 'New-MailboxExportRequest'
        - ' -Mailbox '
export_params:
    - '-FilePath "\\\\' # We care about any share location.
    - '.aspx'
role_assignment:
    '|all':
        - 'New-ManagementRoleAssignment'
        - ' -Role "Mailbox Import Export"'
        - ' -User '
condition: (export_command and export_params) or role_assignment

False positives (as the rule lists them)

• Unlikely

Tags

• attack.persistence
• attack.t1505.003

MITRE ATT&CK ids this rule names

• T1505.003

References

• https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/msexchange/win_exchange_proxyshell_mailbox_export.yml