Skip to content

Hide Navigation Hide TOC

Exchange PowerShell Snap-Ins Usage (25676e10-2121-446e-80a4-71ff8506af47)

Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27

Cluster A Galaxy A Cluster B Galaxy B Level
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736) Attack Pattern Exchange PowerShell Snap-Ins Usage (25676e10-2121-446e-80a4-71ff8506af47) Sigma-Rules 1
Exchange PowerShell Snap-Ins Usage (25676e10-2121-446e-80a4-71ff8506af47) Sigma-Rules Email Collection - T1114 (1608f3e1-598a-42f4-a01a-2e252e81728f) Attack Pattern 1
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736) Attack Pattern Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 2