Remove Exported Mailbox from Exchange Webserver

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•27

This rule detects the removal of an exported Exchange mailbox using the 'Remove-MailboxExportRequest' cmdlet with the '-Confirm "False"' parameter. This activity could indicate an adversary attempting to cover their tracks after exfiltrating data, potentially following an exploit like ProxyShell.