Suspicious PowerShell Mailbox Export to Share
Detects the use of the PowerShell `New-MailboxExportRequest` cmdlet to export a mailbox to a remote or local share, which has been observed in ProxyShell exploitation scenarios. This activity indicates an attempt to exfiltrate mailbox data.
Sigma
