Remove Exported Mailbox from Exchange Webserver

Title: Remove Exported Mailbox from Exchange Webserver
Status: test
Description:Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit
References:
  -https://github.com/rapid7/metasploit-framework/blob/1416b5776d963f21b7b5b45d19f3e961201e0aed/modules/exploits/windows/http/exchange_proxyshell_rce.rb#L430
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-27
modified:2023-01-23
Tags:

• -'attack.stealth'
• -'attack.t1070'

Logsource:

• service: msexchange-management
• product: windows

Detection:
  keywords:
    |all:
      -'Remove-MailboxExportRequest'
      -' -Identity '
      -' -Confirm "False"'

  condition:keywords
Falsepositives:
  -Unknown
Level: high