All Detections

Exchange PowerShell Snap-Ins Usage

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 20252023

Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27

Sigma