{"id":"25676e10-2121-446e-80a4-71ff8506af47","title":"Exchange PowerShell Snap-Ins Usage","description":"Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27","author":"FPT.EagleEye, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2021-03-03","modified":"2023-03-24","tags":["attack.execution","attack.t1059.001","attack.collection","attack.t1114"],"technique_ids":["T1059.001","T1114"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/","https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/","https://www.intrinsec.com/apt27-analysis/"],"source_path":"rules/windows/process_creation/proc_creation_win_powershell_snapins_hafnium.yml","source_sha256":"569cb7447de1447c2825f97973cf1429086408554f8216c2a14cbde5fb8554df","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_snapins_hafnium.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Exchange PowerShell Snap-Ins Usage\nid: 25676e10-2121-446e-80a4-71ff8506af47\nstatus: test\ndescription: Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27\nreferences:\n    - https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/\n    - https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/\n    - https://www.intrinsec.com/apt27-analysis/\nauthor: FPT.EagleEye, Nasreddine Bencherchali (Nextron Systems)\ndate: 2021-03-03\nmodified: 2023-03-24\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.collection\n    - attack.t1114\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith:\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n        - OriginalFileName:\n              - 'PowerShell.EXE'\n              - 'pwsh.dll'\n    selection_cli:\n        CommandLine|contains: 'Add-PSSnapin'\n    selection_module:\n        CommandLine|contains:\n            - 'Microsoft.Exchange.Powershell.Snapin'\n            - 'Microsoft.Exchange.Management.PowerShell.SnapIn'\n    filter_msiexec:\n        # ParentCommandLine: C:\\Windows\\System32\\MsiExec.exe -Embedding C9138ECE2536CB4821EB5F55D300D88E E Global\\MSI0000\n        ParentImage: 'C:\\Windows\\System32\\msiexec.exe'\n        CommandLine|contains: '$exserver=Get-ExchangeServer ([Environment]::MachineName) -ErrorVariable exerr 2> $null'\n    condition: all of selection_* and not 1 of filter_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"},{"key":"enterprise/T1114","id":"T1114","name":"Email Collection","page":"techniques/enterprise/T1114/"}],"data_path":"data/detection-rules/25676e10-2121-446e-80a4-71ff8506af47.json","kind":"sigma"}