Mailbox Export to Exchange Webserver

Title: Mailbox Export to Exchange Webserver
Status: test
Description:Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it
References:
  -https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
Author: Florian Roth (Nextron Systems), Rich Warren, Christian Burkard (Nextron Systems)
Date: 2021-08-09
modified:2023-04-30
Tags:

• -'attack.persistence'
• -'attack.t1505.003'

Logsource:

• service: msexchange-management
• product: windows

Detection:
  export_command:
    |all:
      -'New-MailboxExportRequest'
      -' -Mailbox '

  export_params:
    - '-FilePath "\\\\'
    - '.aspx'
  role_assignment:
    |all:
      -'New-ManagementRoleAssignment'
      -' -Role "Mailbox Import Export"'
      -' -User '

  condition:(export_command and export_params) or role_assignment
Falsepositives:
  -Unlikely
Level: critical