Mailbox export requests removed or mailbox content purged

Siemphony@siemphonylowT1070.008unverified

Matches PowerShell script block logging (EventID 4104) where the recorded block either removes the record of a mailbox export or import job, or issues a cmdlet that permanently deletes message content. The first arm needs no second gate: `Remove-MailboxExportRequest` and `Remove-MailboxImportRequest` are distinctive enough on their own, and removing the request object is the step that erases the evidence a PST was ever produced. The second arm is gated twice — a purging cmdlet (`Search-Mailbox`, `New-ComplianceSearchAction`) *and* the switch that makes it destructive (`-DeleteContent`, `-Purge`) — because both cmdlets are read-only without the switch and are run constantly for discovery. MITRE's `PowerShellCommandMatch` and `CmdletFilter` knobs name `Remove-MailboxExportRequest` and `Remove-*` actions; the purge-switch pairing is authored here. Script Block Logging is off by default and is not enabled by the Microsoft or CIS baselines, so without the *Turn on PowerShell Script Block Logging* policy this rule returns zero rows because the host is blind, not because nothing happened. Two limits are structural. 4104 records the whole block, including comments and help text, so a runbook that merely documents these cmdlets is logged identically to one that runs them. And an Exchange Online administrator working in the admin centre, through Graph, or in a session whose cmdlets execute on Microsoft's side leaves no local 4104 at all — the brief's Office Suite analytic AN0740 really lives in the unified audit log, which this brief's log source list does not contain. The brief's other Windows legs (Sysmon EventID 23 `file_delete` with `TargetFilename`, and Security 4663 with `ObjectName`/`ProcessName`) are separate feeds with their own field names and are not combined here. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0266, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

Event| where (EventID == 4104 and ((ScriptBlockText contains "Remove-MailboxExportRequest" or ScriptBlockText contains "Remove-MailboxImportRequest") or ((ScriptBlockText contains "Search-Mailbox" or ScriptBlockText contains "New-ComplianceSearchAction") and (ScriptBlockText contains "-DeleteContent" or ScriptBlockText contains "-Purge"))))

Splunk · SPL

Run this as a search.

index=* (EventID="4104" AND ((ScriptBlockText="*Remove-MailboxExportRequest*" OR ScriptBlockText="*Remove-MailboxImportRequest*") OR ((ScriptBlockText="*Search-Mailbox*" OR ScriptBlockText="*New-ComplianceSearchAction*") AND (ScriptBlockText="*-DeleteContent*" OR ScriptBlockText="*-Purge*"))))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (event.code == 4104 AND ((TO_LOWER(powershell.file.script_block_text) LIKE "*remove-mailboxexportrequest*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*remove-mailboximportrequest*") OR ((TO_LOWER(powershell.file.script_block_text) LIKE "*search-mailbox*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*new-compliancesearchaction*") AND (TO_LOWER(powershell.file.script_block_text) LIKE "*-deletecontent*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*-purge*"))))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^4104$</field>    <field name="ScriptBlockText" type="pcre2">(?i)(Remove-MailboxExportRequest|Remove-MailboxImportRequest)</field>    <description>Mailbox export requests removed or mailbox content purged (1/2)</description>    <mitre>      <id>T1070.008</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^4104$</field>    <field name="ScriptBlockText" type="pcre2">(?i)(Search-Mailbox|New-ComplianceSearchAction)</field>    <field name="ScriptBlockText" type="pcre2">(?i)(-DeleteContent|-Purge)</field>    <description>Mailbox export requests removed or mailbox content purged (2/2)</description>    <mitre>      <id>T1070.008</id>    </mitre>  </rule></group>

At a glance

Logsource: powershell / windows
Level: low
Category: defense_evasion_clear_logs
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 632b13b8-7972-42a3-93f8-9083ada68573

ATT&CKT1070.008

T1070.008Clear Mailbox Data

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondefense evasion clear logs

defense evasion clear logsAI draft — unreviewed

01 · What this rule detects

AN0737 and AN0740 both describe mailbox evidence removal — export-request cleanup via Exchange PowerShell, and mailbox content deletion. The rule implements the PowerShell half as two arms over EventID 4104: a block that removes the record of a mailbox export or import job, and a block that issues a cmdlet which permanently deletes message content. Two things are out of scope and worth saying plainly. AN0740's transport-rule half (header stripping via New-TransportRule / Set-TransportRule, both named in MITRE's CmdletFilter knob) has no selection here at all. And AN0740 really lives in the Microsoft 365 unified audit log, which this brief's log source list does not contain.

02 · Telemetry you need

product: windows / service: powershell, copied verbatim from AN0737, filtered to EventID: 4104 with ScriptBlockText as the only content field.
Script Block Logging is off by default and is not enabled by the Microsoft or CIS baselines. Without the Turn on PowerShell Script Block Logging policy this rule returns zero rows because the host is blind, not because nothing happened.
There is a second blindness that no policy fixes. An Exchange Online administrator working in the admin centre, through Graph, or in a session whose cmdlets execute on Microsoft's side leaves no local 4104 at all. Arm one is additionally on-prem-only: Exchange Online has no mailbox export request. The brief's other Windows legs — Sysmon EventID 23 file_delete with TargetFilename, Security 4663 with ObjectName/ProcessName — are separate feeds with their own field names.

03 · How the logic works

selection_eventid pins the event, then the condition ORs two arms beneath it. selection_request_cleanup needs no partner: Remove-MailboxExportRequest and Remove-MailboxImportRequest are distinctive on their own, and removing the request object is precisely the step that erases the evidence a PST was ever produced. MITRE's PowerShellCommandMatch knob names the first of these. The second arm is gated twice, and that pairing is the authored part. selection_purge_cmdlet matches Search-Mailbox or New-ComplianceSearchAction; selection_purge_switch matches -DeleteContent or -Purge. Both are required, because both cmdlets are read-only without the switch and are run constantly for discovery. Gating on the cmdlet alone would alert on every eDiscovery search. The AND is also the arm's weakness. PowerShell resolves any unambiguous parameter prefix, and Search-Mailbox has no other parameter starting Delete, so -Delete and -DeleteC execute identically and match nothing — abbreviating one switch drops the whole arm rather than degrading it.

04 · Common false positives

Routine Exchange administration dominates on any estate that exports mailboxes. Remove-MailboxExportRequest is the documented final step of every New-MailboxExportRequest job — migrations, legal hold, PST archiving — usually as a scheduled loop clearing completed requests, and it looks identical to an operator deleting the record of their own export. Then phishing response using New-ComplianceSearchAction -Purge, helpdesk clearing a mail storm with Search-Mailbox -DeleteContent, and mere mentions: 4104 logs the whole block, so Get-Help Remove-MailboxExportRequest or importing a module whose comment-based help names these cmdlets produces a match. level: low is the honest reading.

05 · Detection maturity

tier_1: , and it cannot leave until it has been run against real data. It is machine-derived from a MITRE scaffold with no query logic and has never been executed against a log line.
tier_2: confirm Script Block Logging is on, baseline a fortnight of hits, and turn the migration and eDiscovery accounts into the exclusion block the rule does not yet have.
tier_3: ** join local 4104 to the unified audit log so cloud-side purges stop being invisible.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Match the stem -Delete rather than -DeleteContent, so every valid abbreviation
Populate MITRE's UserRoleScope knob. Excluding the migration service account and
Correlate against the matching New-MailboxExportRequest. A removal with no
For real coverage of AN0740, ingest the unified audit log rather than widening this

Declared by the author

Routine Exchange administration, which is the highest-volume match here by a wide margin on any estate that exports mailboxes. Remove-MailboxExportRequest is the documented final step of every New-MailboxExportRequest job — migrations, legal-hold collections and PST archiving all end with it, usually as a scheduled loop that clears every completed request — and it looks identical to an operator deleting the record of their own export.
Phishing response by the security or messaging team, which removes a reported malicious message from every mailbox with New-ComplianceSearchAction -Purge; the cmdlet, the switch and often the operator account are the same ones an adversary would use to remove their own phish.
Helpdesk remediation with Search-Mailbox -DeleteContent, used to clear a mail storm, an oversized attachment or a mis-sent all-staff message out of an affected mailbox.
Documentation and tooling that merely mentions the cmdlets, since 4104 logs the full script block: an administrator running Get-Help Remove-MailboxExportRequest, opening a runbook in the ISE, or loading a module whose comment-based help contains these names all produce a matching block.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1070.008, evaluated against their — events.

Share this rule

/u/siemphony/632b13b8-7972-42a3-93f8-9083ada68573

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Mailbox export requests removed or mailbox content purged

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it