Exchange Mailbox Export via PowerShell

Last updated 8 days ago on 2026-01-26

Created 3 years ago on 2023-01-11

About

Detects PowerShell script block content that creates Exchange mailbox export requests via New-MailboxExportRequest, commonly writing PST files. Adversaries can abuse export requests to collect and stage email content for exfiltration.

Tags

Domain: EndpointOS: WindowsUse Case: Threat DetectionTactic: CollectionData Source: PowerShell LogsLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Collection (TA0009)(external, opens in a new tab or window)

↳ Data from Local System (T1005)(external, opens in a new tab or window)

↳ Email Collection (T1114)(external, opens in a new tab or window)

False Positive Examples

Legitimate exchange system administration activity.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Query (Kibana Query Language)
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: winlogbeat-*logs-windows.powershell*
Related Integrations: windows(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗event.category:process and host.os.type:windows and
powershell.file.script_block_text : "New-MailboxExportRequest" and
(
  powershell.file.script_block_text : ("-FilePath" or ".pst") and
  powershell.file.script_block_text : ("-Mailbox" or "Get-Mailbox" or "ExportToPSTFile" or "-Identity")
)

Install detection rules in Elastic Security

Detect Exchange Mailbox Export via PowerShell in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).