detect-mailsniper

This query was originally published in the threat analytics report, MailSniper Exchange attack tool. MailSniper is a tool that targets Microsoft Exchange Server. The core function is to connect to Exchange Server and search through emails. In support of this, it can perform reconnaissance, collection, exfiltration, and credential theft. MailSniper is used both by red teams running penetration tests, and by malicious actors. Microsoft Defender Security Center may record the following alerts during and after an attack: 1. Global mail search on Exchange using MailSniper 2. Exchange mailbox or mail folder search using MailSniper 3. Enumeration of Active Directory usernames using MailSniper 4. Enumeration of the Exchange GAL using MailSniper 5. Access to Exchange inboxes using MailSniper 6. Password spraying using MailSniper 7. Enumeration of domains and user accounts using MailSniper The following query detects activity commonly associated with attacks run with MailSniper. Reference - https://github.com/dafthack/MailSniper