Identify unusual identity additions related to EUROPIUM

Description

This query looks for identity add through exchange PowerShell

Query · kql

DeviceProcessEvents 
| where ProcessCommandLine has_any ("New-Mailbox","Update-RoleGroupMember") and ProcessCommandLine has "HealthMailbox55x2yq"
Raw source Identify unusual identity additions related to EUROPIUM · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 5daf2787-98b1-4c38-8487-107076a97930
name: Identify unusual identity additions related to EUROPIUM
description: |
  This query looks for identity add through exchange PowerShell
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Persistence
query: |
  DeviceProcessEvents 
  | where ProcessCommandLine has_any ("New-Mailbox","Update-RoleGroupMember") and ProcessCommandLine has "HealthMailbox55x2yq"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.