# Source: https://docs.datadoghq.com/security/default_rules/def-000-316.md

---
title: Windows suspicious PowerShell mailbox export to share
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Windows suspicious PowerShell mailbox
  export to share
---

# Windows suspicious PowerShell mailbox export to share

{% alert level="danger" %}
This rule is part of a beta feature. To learn more, [contact Support](https://docs.datadoghq.com/help/).
{% /alert %}
Classification:attackTactic:[TA0006-credential-access](https://attack.mitre.org/tactics/TA0006)Technique:[T1078-valid-accounts](https://attack.mitre.org/techniques/T1078) 
## Goal{% #goal %}

Detects Exchange PowerShell commands that export mailbox contents to file shares for potential data exfiltration.

## Strategy{% #strategy %}

This rule monitors PowerShell script block logging through `@Event.EventData.Data.ScriptBlockText` for Exchange management commands using `New-MailboxExportRequest` with both `-Mailbox` and `-FilePath` parameters. The cmdlet exports mailbox contents to PST files at specified network locations.

While this functionality serves legitimate administrative purposes, it represents a high-risk activity that allows attackers with Exchange management privileges to collect email data en masse for exfiltration. The exported PST files contain complete mailbox contents that can be easily transferred outside the organization.

## Triage & Response{% #triage--response %}

- Examine the full PowerShell command on `{{host}}` to identify targeted mailboxes and export destinations.
- Verify authorization status and business justification for the export operation.
- Evaluate the legitimacy of the destination path for exported PST files.
- Check file sizes and contents of exported mailbox data.
- Monitor for subsequent file transfer or archiving activities.
- Track additional access to mailboxes by the same user account.
- Review Exchange audit logs for additional suspicious activities.