Analytics BIOC
Medium
✕
PowerShell used to export mailbox contents
An attacker may use PowerShell to export the contents of a mailbox as part of the data staging before exfiltration.
- Module:
- Platform Analytics
- Data source:
- Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Collection (TA0009)
ATT&CK techniques: Data Staged: Local Data Staging (T1074.001)
Attacker's goals:
Export the content of a mailbox, preparing for data exfiltration.
Investigative actions:
Examine the PowerShell command to identify which mailbox has been exported. Verify that this command was executed by a trusted source.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day