Suspect Mailbox Export on IIS/OWA

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index


The hunting query looks for suspicious files accessed on a IIS server that might indicate exfiltration hosting. This technique has been observed when exporting mailbox files from OWA servers.

Attribute Value
Type Hunting Query
Solution Standalone Content
ID a523786c-8382-4029-80e9-f1a7ecd067c1
Severity Low
Tactics Exfiltration
Techniques T1567
Required Connectors AzureMonitor(IIS)
Source [View on GitHub](https://github.com/Azure/Azure-Sentinel/blob/master/Hunting Queries/W3CIISLog/SuspectedMailBoxExportHostonOWA.yaml)

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
W3CIISLog cIP !startswith "127."
cIP !startswith "::"
cIP !startswith "fe80"
csUriStem contains "/owa/"
✓ ✗ ✗

Associated Connectors

The following connectors provide data for this content item:

Connector Solution
ESI-Opt5ExchangeIISLogs Microsoft Exchange Security - Exchange On-Premises

Solutions: Microsoft Exchange Security - Exchange On-Premises


Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Hunting Queries