Mailbox search and export tooling in a script block

Siemphony@siemphonymediumT1114.002unverified

Matches the scripted-access half of AN0131: a PowerShell script block that names a bulk mailbox search or export cmdlet, one of the published mail-harvesting toolkits, the Graph message-reading cmdlets, or the Exchange Web Services assembly. The whole selection sits on `ScriptBlockText` under EventID 4104, which is the only field in this log source that carries the script text as the engine compiled it — so an `-EncodedCommand` payload arrives decoded, but decoded is not deobfuscated: name splitting (`"Sea"+"rch-Mailbox"`), backtick insertion and wildcard command resolution (`&(gcm Sear*-Mailbox)`) all survive compilation and defeat every literal term below. The interactive-administration cmdlet Connect-ExchangeOnline is deliberately left out: it is how every legitimate session to the service also begins, so including it would make the rule fire on ordinary administration. The rule can only see a host whose PowerShell is being logged — an adversary reaching the mailbox from an unmanaged machine, a browser session or a direct Graph call writes nothing here, and the Office Suite side of this technique lives in the tenant's own audit log rather than in any Windows event channel. The brief's other two log sources, Sysmon EventID 3 and 22, were not used: a connection or a DNS lookup to a mail service endpoint is what every mail client on the estate does all day, so neither carries a signal at the single-event level. EventID 4104 requires *Script Block Logging* to be enabled by policy; it is off in a default install, and with it off this rule returns zero rows, which reads as quiet when it means blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0048, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

Event| where (EventID == 4104 and (ScriptBlockText contains "Invoke-GlobalMailSearch" or ScriptBlockText contains "Invoke-SelfSearch" or ScriptBlockText contains "Invoke-OpenInboxFinder" or ScriptBlockText contains "Get-GlobalAddressList" or ScriptBlockText contains "Search-Mailbox" or ScriptBlockText contains "New-MailboxSearch" or ScriptBlockText contains "New-MailboxExportRequest" or ScriptBlockText contains "New-ComplianceSearchAction" or ScriptBlockText contains "Get-MgUserMessage" or ScriptBlockText contains "Get-MgUserMailFolderMessage" or ScriptBlockText contains "Microsoft.Exchange.WebServices" or ScriptBlockText contains "AADInternals"))

Splunk · SPL

Run this as a search.

index=* (EventID="4104" AND (ScriptBlockText="*Invoke-GlobalMailSearch*" OR ScriptBlockText="*Invoke-SelfSearch*" OR ScriptBlockText="*Invoke-OpenInboxFinder*" OR ScriptBlockText="*Get-GlobalAddressList*" OR ScriptBlockText="*Search-Mailbox*" OR ScriptBlockText="*New-MailboxSearch*" OR ScriptBlockText="*New-MailboxExportRequest*" OR ScriptBlockText="*New-ComplianceSearchAction*" OR ScriptBlockText="*Get-MgUserMessage*" OR ScriptBlockText="*Get-MgUserMailFolderMessage*" OR ScriptBlockText="*Microsoft.Exchange.WebServices*" OR ScriptBlockText="*AADInternals*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (event.code == 4104 AND (TO_LOWER(powershell.file.script_block_text) LIKE "*invoke-globalmailsearch*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*invoke-selfsearch*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*invoke-openinboxfinder*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*get-globaladdresslist*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*search-mailbox*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*new-mailboxsearch*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*new-mailboxexportrequest*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*new-compliancesearchaction*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*get-mgusermessage*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*get-mgusermailfoldermessage*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*microsoft.exchange.webservices*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*aadinternals*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^4104$</field>    <field name="ScriptBlockText" type="pcre2">(?i)(Invoke-GlobalMailSearch|Invoke-SelfSearch|Invoke-OpenInboxFinder|Get-GlobalAddressList|Search-Mailbox|New-MailboxSearch|New-MailboxExportRequest|New-ComplianceSearchAction|Get-MgUserMessage|Get-MgUserMailFolderMessage|Microsoft\.Exchange\.WebServices|AADInternals)</field>    <description>Mailbox search and export tooling in a script block</description>    <mitre>      <id>T1114.002</id>    </mitre>  </rule></group>

At a glance

Logsource: powershell / windows
Level: medium
Category: data_staging_exfil
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: ec936456-d20b-45c7-a947-520b183dae43

ATT&CKT1114.002

T1114.002Remote Email Collection

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

AN0131 describes stolen credentials or OAuth tokens used against a remote mail system, followed by scripted access to mailbox contents. This rule implements the scripted-access clause and nothing else: a PowerShell script block naming a bulk mailbox search or export cmdlet, one of the published mail-harvesting toolkits, the Graph message-reading cmdlets, or the Exchange Web Services assembly. The abnormal-logon half — user agent, IP location, session anomaly — is not in this feed.

02 · Telemetry you need

product: windows / service: powershell, from AN0131's first log source. EventID 4104 requires Script Block Logging enabled by policy; it is off in a default install, and with it off the rule returns zero rows, which reads as quiet when it means blind.
The rule can only see a host whose PowerShell is logged. An adversary reaching the mailbox from an unmanaged machine, a browser session or a direct Graph call writes nothing here, and the Office Suite side of this technique lives in the tenant's own audit log rather than in any Windows event channel. The brief's other two sources, Sysmon EventID 3 and 22, were not used: a connection or DNS lookup to a mail endpoint is what every mail client on the estate does all day.

03 · How the logic works

One selection: EventID: 4104 ANDed with twelve contains terms on ScriptBlockText. The terms fall into four groups. MailSniper's functions — Invoke-GlobalMailSearch, Invoke-SelfSearch, Invoke-OpenInboxFinder, Get-GlobalAddressList — plus the AADInternals module name. Exchange bulk operations: Search-Mailbox, New-MailboxSearch, New-MailboxExportRequest, New-ComplianceSearchAction. Graph SDK message readers: Get-MgUserMessage and Get-MgUserMailFolderMessage. And the EWS managed API assembly Microsoft.Exchange.WebServices. Connect-ExchangeOnline is deliberately absent — every legitimate session to the service also begins with it, so including it would make the rule fire on ordinary administration. ScriptBlockText carries the script as the engine compiled it, so an -EncodedCommand payload arrives decoded. Decoded is not deobfuscated: name splitting ("Sea"+"rch-Mailbox"), backtick insertion and wildcard command resolution (&(gcm Sear*-Mailbox)) all survive compilation and defeat every literal term above. One triage note: New-MailboxExportRequest writes a PST to a UNC path, so it evidences local staging as much as remote collection. Read a hit alongside its destination path.

04 · Common false positives

Migration and offboarding runbooks call New-MailboxExportRequest once per migrated user, producing a dense burst from a single service account for the whole migration window. Compliance and legal-hold teams use Search-Mailbox, New-MailboxSearch and New-ComplianceSearchAction as their supported tooling — the same cmdlets an adversary reaches for, run by the team whose job it is. Reporting, archiving and backup scripts page Get-MgUserMessage across many mailboxes on a schedule, usually as an app-only identity at a fixed hour. Authorised red-team and phishing-simulation work matches the entire MailSniper group. And Microsoft.Exchange.WebServices matches every legacy admin script doing Add-Type -Path ...\Microsoft.Exchange.WebServices.dll — signature management, archiving, third-party backup — with no mailbox search involved.

05 · Detection maturity

tier_1: , and it stays there until it has been run against real data. It is machine-derived from a MITRE scaffold containing no query logic and has never been executed against a log line.
tier_2: enable Script Block Logging, run read-only, rank hits by account and term, and convert the recurring runbooks into allowlists.
tier_3: * join the script block to the tenant sign-in log so an alert means unexpected identity harvesting mail*, rather than the fact that a mailbox cmdlet was typed.

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Allowlist the migration and backup service accounts. That is a local step, not
Split the terms by expected volume. The toolkit names deserve a higher level
Add the compliance team's own jump hosts as a Computer exclusion rather than
Correlate downstream on MITRE's TimeWindow against the sign-in telemetry

Declared by the author

Mailbox migration and offboarding runbooks, which call New-MailboxExportRequest once per migrated user and so produce a dense burst of matches from a service account for the whole length of a migration window. An allowlist of the migration service accounts is the first tuning step, and it is a local one — MITRE's knobs for this analytic are UserAgentPattern, TimeWindow, KnownIPLocations and PrivilegedUserList, and the last of those is a list of accounts to scrutinise harder, not accounts to excuse.
Compliance and legal-hold work, where Search-Mailbox, New-MailboxSearch and New-ComplianceSearchAction are the supported way to run an eDiscovery search or pull a phishing message out of every mailbox in the tenant — the same cmdlets an adversary would reach for, run by the team whose job it is.
Reporting, archiving and backup scripts built on the Graph SDK that page through Get-MgUserMessage across many mailboxes on a schedule, usually as an app-only identity at a fixed hour.
Authorised assessment and phishing-simulation work, where MailSniper is the standard tool and Invoke-GlobalMailSearch is its headline function; an internal red team exercise will match every entry in the first group of terms.
Identity administrators importing AADInternals for legitimate tenant investigation and token work, which matches on the module name alone with no mailbox access at all.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1114.002, evaluated against their — events.

Share this rule

/u/siemphony/ec936456-d20b-45c7-a947-520b183dae43

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Mailbox search and export tooling in a script block

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it