Mailbox export requests removed or mailbox content purged

1title: Mailbox export requests removed or mailbox content purged2id: 632b13b8-7972-42a3-93f8-9083ada685733status: experimental4description: |5  Matches PowerShell script block logging (EventID 4104) where the recorded6  block either removes the record of a mailbox export or import job, or issues7  a cmdlet that permanently deletes message content. The first arm needs no8  second gate: `Remove-MailboxExportRequest` and `Remove-MailboxImportRequest`9  are distinctive enough on their own, and removing the request object is the10  step that erases the evidence a PST was ever produced. The second arm is11  gated twice — a purging cmdlet (`Search-Mailbox`,12  `New-ComplianceSearchAction`) *and* the switch that makes it destructive13  (`-DeleteContent`, `-Purge`) — because both cmdlets are read-only without14  the switch and are run constantly for discovery. MITRE's15  `PowerShellCommandMatch` and `CmdletFilter` knobs name16  `Remove-MailboxExportRequest` and `Remove-*` actions; the purge-switch pairing17  is authored here. Script Block Logging is off by default and is not enabled by18  the Microsoft or CIS baselines, so without the *Turn on PowerShell Script19  Block Logging* policy this rule returns zero rows because the host is blind,20  not because nothing happened. Two limits are structural. 4104 records the21  whole block, including comments and help text, so a runbook that merely22  documents these cmdlets is logged identically to one that runs them. And an23  Exchange Online administrator working in the admin centre, through Graph, or24  in a session whose cmdlets execute on Microsoft's side leaves no local 4104 at25  all — the brief's Office Suite analytic AN0740 really lives in the unified26  audit log, which this brief's log source list does not contain. The brief's27  other Windows legs (Sysmon EventID 23 `file_delete` with `TargetFilename`, and28  Security 4663 with `ObjectName`/`ProcessName`) are separate feeds with their29  own field names and are not combined here.30  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0266, not hand-written and not tested by its author. Any lab result is on this rule's own page.31references:32  - https://attack.mitre.org/techniques/T1070/00833  - https://attack.mitre.org/detectionstrategies/DET026634author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)35date: 2026-08-1636tags:37  - attack.defense-evasion38  - attack.t1070.00839logsource:40  product: windows41  service: powershell42detection:43  selection_eventid:44    EventID: 410445  selection_request_cleanup:46    ScriptBlockText|contains:47      - 'Remove-MailboxExportRequest'48      - 'Remove-MailboxImportRequest'49  selection_purge_cmdlet:50    ScriptBlockText|contains:51      - 'Search-Mailbox'52      - 'New-ComplianceSearchAction'53  selection_purge_switch:54    ScriptBlockText|contains:55      - '-DeleteContent'56      - '-Purge'57  condition: selection_eventid and (selection_request_cleanup or (selection_purge_cmdlet and selection_purge_switch))58falsepositives:59  - "Routine Exchange administration, which is the highest-volume match here by a wide margin on any estate that exports mailboxes. `Remove-MailboxExportRequest` is the documented final step of every `New-MailboxExportRequest` job — migrations, legal-hold collections and PST archiving all end with it, usually as a scheduled loop that clears every completed request — and it looks identical to an operator deleting the record of their own export."60  - "Phishing response by the security or messaging team, which removes a reported malicious message from every mailbox with `New-ComplianceSearchAction -Purge`; the cmdlet, the switch and often the operator account are the same ones an adversary would use to remove their own phish."61  - "Helpdesk remediation with `Search-Mailbox -DeleteContent`, used to clear a mail storm, an oversized attachment or a mis-sent all-staff message out of an affected mailbox."62  - "Documentation and tooling that merely mentions the cmdlets, since 4104 logs the full script block: an administrator running `Get-Help Remove-MailboxExportRequest`, opening a runbook in the ISE, or loading a module whose comment-based help contains these names all produce a matching block."63level: low