Exchange PowerShell Cmdlet History Deleted

testhigh
Log-Quelle: windows · file_deleteAutor Nasreddine Bencherchali (Nextron Systems)Datum 2022-10-26
01

Beschreibung

Was dies ist, in Kürze.

Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence

02

Tags

attack.stealthattack.t1070
03

Regelquelle (YAML)

title: Exchange PowerShell Cmdlet History Deleted
id: a55349d8-9588-4c5a-8e3b-1925fe2a4ffe
status: test
description: Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence
references:
    - https://web.archive.org/web/20221012062917/https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/
    - https://www.it-server-room.com/en/exchange-server-log-file-locations-and-cleanup-guide/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-10-26
modified: 2026-10-13
tags:
    - attack.stealth
    - attack.t1070
logsource:
    category: file_delete
    product: windows
detection:
    selection:
        TargetFilename|contains|all:
            - '\Logging\CmdletInfra\LocalPowerShell\Cmdlet\'
            - '_Cmdlet_'
    condition: selection
falsepositives:
    - Possible FP during log rotation
level: high
04

erkennt Techniken (1)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

05

Referenzen

Externe Belege — Patches, Meldungen, Analysen.