Email data exfiltration via PowerShell

Description

Identify email exfiltration conducted by PowerShell.

Query · kql

DeviceProcessEvents 
| where FileName =~ 'powershell.exe' 
| where ProcessCommandLine has_all('Add-PSSnapin', 'Get-Recipient', '-ExpandProperty', 'EmailAddresses', 'SmtpAddress', '-hidetableheaders')
Raw source Email data exfiltration via PowerShell · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 1115e499-45a0-470c-b0ec-e2f204831341
name: Email data exfiltration via PowerShell
description: |
  Identify email exfiltration conducted by PowerShell.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Exfiltration
query: |   
  DeviceProcessEvents 
  | where FileName =~ 'powershell.exe' 
  | where ProcessCommandLine has_all('Add-PSSnapin', 'Get-Recipient', '-ExpandProperty', 'EmailAddresses', 'SmtpAddress', '-hidetableheaders')

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.