Exchange PowerShell Snap-Ins Usage for Data Export

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•25

Detects the use of PowerShell to add Exchange snap-ins and potentially export mailbox data. This activity has been observed in attacks by threat groups such as HAFNIUM and APT27, often as part of post-exploitation to collect sensitive information from Exchange servers.