Tag
M365 Exchange Inbox Rule with Obfuscated Name
2 rules 2 TTPsThis rule detects when a Microsoft Exchange inbox rule is created or modified with a name composed only of special characters, which adversaries may use to evade detection and hide malicious forwarding or deletion rules.
Microsoft Exchange Server Vulnerability Could Allow Arbitrary Code Execution
2 rules 1 TTPA vulnerability in Microsoft Exchange Server allows for arbitrary code execution, potentially enabling attackers to execute malicious JavaScript within a user's browser context to steal data or install malware.
CVE-2026-42897 Microsoft Exchange Server Cross-Site Scripting Vulnerability
2 rules 2 TTPs 1 CVE 7 IOCsCVE-2026-42897 is a cross-site scripting (XSS) vulnerability in Microsoft Exchange Server that allows an attacker to perform spoofing attacks by injecting malicious scripts into web pages.
Exchange Mailbox Export via PowerShell
2 rules 4 TTPsAdversaries may use the `New-MailboxExportRequest` PowerShell cmdlet to export mailboxes to PST files for sensitive data collection.
Microsoft Exchange Server UM Spawning Suspicious Processes
2 rules 2 TTPs 1 CVEThis rule detects suspicious processes spawned by the Microsoft Exchange Server Unified Messaging (UM) service, potentially indicating exploitation of CVE-2021-26857 and leading to unauthorized process execution and system compromise.
Suspicious File Creation by Microsoft Exchange Unified Messaging Service
2 rules 3 TTPs 1 CVEThis rule detects suspicious file creations by the Microsoft Exchange Server Unified Messaging service, potentially indicative of exploitation of CVE-2021-26858, leading to web shell deployment for initial access, lateral movement, and persistence.
Suspicious Processes Spawned by Microsoft Exchange Worker Process
2 rules 4 TTPsThe Microsoft Exchange Server worker process (w3wp.exe) spawning command-line interpreters such as cmd.exe or powershell.exe may indicate exploitation of Exchange vulnerabilities or access to a web shell backdoor, leading to unauthorized access and code execution.
New ActiveSync Allowed Device Added via PowerShell
2 rules 3 TTPsThe rule detects the use of the Exchange PowerShell cmdlet, Set-CASMailbox, to add a new ActiveSync allowed device, potentially allowing attackers to gain persistent access to sensitive email data by adding unauthorized devices.
M365 Exchange Inbox Forwarding Rule Creation
2 rules 1 TTPDetection of new Microsoft 365 Exchange inbox forwarding rules indicating potential unauthorized email interception and exfiltration by attackers.
Exchange Mailbox Export via PowerShell
2 rules 4 TTPsAdversaries may use the New-MailboxExportRequest PowerShell cmdlet to export mailboxes in Exchange, potentially leading to sensitive information theft.
Exchange PowerShell Used to Add New ActiveSync Allowed Device
2 rules 3 TTPsAn adversary may use the Exchange PowerShell cmdlet, Set-CASMailbox, to add a new ActiveSync allowed device, potentially gaining persistent access to a user's email and sensitive information.