Host Exporting Mailbox and Removing Export (Normalized Process Events)

id: 4500a2ff-455b-4ee7-a21d-5ac5c7c9ea87
name: Host Exporting Mailbox and Removing Export (Normalized Process Events)
description: |
  'This hunting query looks for hosts exporting a mailbox from an on-prem Exchange server, followed by
  that same host removing the export within a short time window. This pattern has been observed by attackers 
  when exfiltrating emails from a target environment. A Mailbox export is unlikely to be a common command run so look for
  activity from unexpected hosts and accounts.
  Reference: https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/'
requiredDataConnectors: []
tactics:
  - Collection
relevantTechniques:
  - T1114
tags:
  - Solorigate
  - NOBELIUM
query: |

  // Adjust the timeframe to change the window events need to occur within to alert
   let timeframe = 1h;
   imProcessCreate
   | where Process has_any ("powershell.exe", "cmd.exe")
   | where CommandLine has 'New-MailboxExportRequest'
   | summarize by Dvc, timekey = bin(TimeGenerated, timeframe), CommandLine, ActorUsername, EventVendor, EventProduct
   | join kind=inner (imProcessCreate
   | where Process has_any ("powershell.exe", "cmd.exe")
   | where CommandLine has 'Remove-MailboxExportRequest'
   | summarize by Dvc, EventProduct, EventVendor, timekey = bin(TimeGenerated, timeframe), CommandLine, ActorUsername) on Dvc, timekey, ActorUsername
   | summarize by timekey, Dvc, CommandLine, ActorUsername
   | project-reorder timekey, Dvc, ActorUsername, CommandLine
   | extend HostCustomEntity = Dvc, AccountCustomEntity = ActorUsername

entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: HostCustomEntity