{"id":"09570ae5-889e-43ea-aac0-0e1221fb3d95","title":"Remove Exported Mailbox from Exchange Webserver","description":"Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-27","modified":"2023-01-23","tags":["attack.stealth","attack.t1070"],"technique_ids":["T1070"],"logsource":{"service":"msexchange-management","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/rapid7/metasploit-framework/blob/1416b5776d963f21b7b5b45d19f3e961201e0aed/modules/exploits/windows/http/exchange_proxyshell_rce.rb#L430"],"source_path":"rules/windows/builtin/msexchange/win_exchange_proxyshell_remove_mailbox_export.yml","source_sha256":"93d7a165b6055e5190313c883e733804ba4ace766632df0439b4726efd936641","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/msexchange/win_exchange_proxyshell_remove_mailbox_export.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Remove Exported Mailbox from Exchange Webserver\nid: 09570ae5-889e-43ea-aac0-0e1221fb3d95\nstatus: test\ndescription: Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit\nreferences:\n    - https://github.com/rapid7/metasploit-framework/blob/1416b5776d963f21b7b5b45d19f3e961201e0aed/modules/exploits/windows/http/exchange_proxyshell_rce.rb#L430\nauthor: Christian Burkard (Nextron Systems)\ndate: 2021-08-27\nmodified: 2023-01-23\ntags:\n    - attack.stealth\n    - attack.t1070\nlogsource:\n    service: msexchange-management\n    product: windows\ndetection:\n    keywords:\n        '|all':\n            - 'Remove-MailboxExportRequest'\n            - ' -Identity '\n            - ' -Confirm \"False\"'\n    condition: keywords\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1070","id":"T1070","name":"Indicator Removal","page":"techniques/enterprise/T1070/"}],"data_path":"data/detection-rules/09570ae5-889e-43ea-aac0-0e1221fb3d95.json","kind":"sigma"}