CISA AA26-281a: Chinese State-Linked Actors Blending Automated Scanning and Hands-On Intrusion to Hit Exchange and Exfiltrate Email — Detection and Defense Guide

---
title: Exchange Mailbox Export or Email Collection via Script
id: 4f2a9c31-7b6e-4d58-a1c2-9e8f0d3b5a71
status: experimental
description: Detects scripted email collection on Exchange servers consistent with AA26-281a exfiltration TTPs, including Exchange Management Shell mailbox export cmdlets and direct access to mailbox data stores.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a
  - https://attack.mitre.org/techniques/T1114/
author: Security Arsenal
date: 2026/10/09
tags:
  - attack.collection
  - attack.t1114.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmdlet:
    CommandLine|contains:
      - 'New-MailboxExportRequest'
      - 'Export-Mailbox'
      - 'Get-MailboxExportRequest'
      - 'Search-Mailbox'
  selection_shell:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
  selection_paths:
    CommandLine|contains:
      - '\\*.pst'
      - 'Program Files\\Microsoft\\Exchange Server'
  condition: selection_cmdlet or (selection_shell and selection_paths)
falsepositives:
  - Legitimate eDiscovery or compliance export by Exchange administrators
  - Backup solutions performing mailbox-level export
level: high
---
title: Password Spraying Pattern Against Exchange Authentication
id: 8c1d5e72-3a4f-4b89-b2d7-6f9a1c4e8d03
status: experimental
description: Detects password spraying behavior against Exchange (OWA/EWS/Autodiscover) characterized by many failed logons across distinct accounts from a single source, consistent with AA26-281a initial access TTPs. Deploy as a threshold-based correlation in your SIEM; this rule defines the atomic failure event.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a
  - https://attack.mitre.org/techniques/T1110/003/
author: Security Arsenal
date: 2026/10/09
tags:
  - attack.credential_access
  - attack.t1110.003
logsource:
  product: windows
  service: security
detection:
  selection:
    LogonType: 3
    LogonProcessName:
      - 'Advapi'
      - 'NtLmSsp'
    FailureReason|contains: '%%2313'
  filter_known:
    IpAddress:
      - '127.0.0.1'
      - '::1'
  condition: selection and not filter_known
falsepositives:
  - Misconfigured service accounts with stale credentials
  - Mobile devices retrying expired passwords via EWS/ActiveSync
level: medium
---
title: Rogue VPN Client Installation or Execution for Persistence
id: 2e7b4f19-5c83-4a96-d3e1-8a6f2b9c7e54
status: experimental
description: Detects installation or execution of VPN client software on servers where VPN clients are not expected (Exchange, domain controllers, application servers), consistent with AA26-281a persistence via VPN software.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a
  - https://attack.mitre.org/techniques/T1133/
author: Security Arsenal
date: 2026/10/09
tags:
  - attack.persistence
  - attack.t1133
  - attack.t1078
logsource:
  category: process_creation
  product: windows
detection:
  selection_vpn:
    Image|contains:
      - '\openvpn'
      - '\wireguard'
      - '\tailscale'
      - '\zerotier'
      - '\softether'
      - '\anyconnect'
      - '\GlobalProtect'
      - '\forticlient'
  selection_server:
    Computer|contains:
      - 'EXCH'
      - '-DC-'
      - 'SRV'
  condition: selection_vpn and selection_server
falsepositives:
  - Approved remote access tooling deployed by IT; maintain an allowlist of sanctioned VPN binaries and server naming conventions
level: high

// Hunt 1: Password spraying against Exchange followed by successful authentication
let sprayWindow = 1h;
let failThreshold = 20;
let FailedSpray = SecurityEvent
| where EventID == 4625
| where LogonType == 3
| where IpAddress !in ("127.0.0.1", "::1", "-")
| summarize FailedAccounts = dcount(Account), FailedAttempts = count(),
            Accounts = make_set(Account, 50) by IpAddress, bin(TimeGenerated, sprayWindow)
| where FailedAccounts >= failThreshold
| project SprayTime = TimeGenerated, IpAddress, FailedAccounts, FailedAttempts;
let SuccessfulLogons = SecurityEvent
| where EventID == 4624
| where LogonType in (3, 8, 10)
| project SuccessTime = TimeGenerated, IpAddress, Account, Computer;
FailedSpray
| join kind=inner SuccessfulLogons on IpAddress
| where SuccessTime between (SprayTime .. SprayTime + 4h)
| project SprayTime, SuccessTime, IpAddress, Account, Computer, FailedAccounts, FailedAttempts
| sort by SprayTime desc;

// Hunt 2: Scripted mailbox export / email collection on Exchange servers
DeviceProcessEvents
| where DeviceName has_any ("EXCH", "EX-")  // tune to your Exchange naming convention
| where ProcessCommandLine has_any (
    "New-MailboxExportRequest", "Export-Mailbox", "Search-Mailbox",
    "Get-MailboxExportRequest", ".pst")
| project TimeGenerated, DeviceName, AccountName, FileName,
          ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName
| sort by TimeGenerated desc;

// Hunt 3: Unexpected VPN/tunneling client execution on servers
DeviceProcessEvents
| where DeviceName has_any ("EXCH", "SRV", "DC")  // tune to your server naming convention
| where FileName has_any ("openvpn", "wireguard", "tailscale", "zerotier",
    "softether", "vpnagent", "forticlient", "panGP", "anyconnect")
   or ProcessCommandLine has_any ("--config", "tun0", "wireguard", "openvpn")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine,
          AccountName, SHA256, InitiatingProcessFileName
| sort by TimeGenerated desc;

-- Hunt for AA26-281a TTPs: scripted email collection, PST staging, rogue VPN clients
LET procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(New-MailboxExportRequest|Export-Mailbox|Search-Mailbox|\.pst|openvpn|wireguard|tailscale|zerotier|softether)'
   OR Name =~ '(?i)(openvpn|wireguard|tailscaled|zerotier|vpnagent)'

LET staged_pst = SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=['C:/Users/*/*.pst', 'C:/ProgramData/**/*.pst',
                 'C:/Windows/Temp/**/*.pst', 'C:/Temp/**/*.zip',
                 'C:/Windows/Temp/*.7z', 'C:/Windows/Temp/*.rar'])
WHERE Mtime > now() - 1209600  -- artifacts created in the last 14 days

SELECT 'Process' AS ArtifactType, Name AS Item, CommandLine AS Detail,
       Username AS Context, CreateTime AS Timestamp
FROM procs
UNION ALL
SELECT 'StagedFile' AS ArtifactType, FullPath AS Item,
       format(format='Size: %d bytes', args=[Size]) AS Detail,
       '' AS Context, Mtime AS Timestamp
FROM staged_pst
ORDER BY Timestamp DESC

#Requires -RunAsAdministrator
# AA26-281a Exchange Server Audit & Hardening - Security Arsenal
# Run inside Exchange Management Shell on each Exchange server

$report = @()
$reportDir = "C:\SecurityAudit_$(Get-Date -Format 'yyyyMMdd_HHmm')"
New-Item -Path $reportDir -ItemType Directory -Force | Out-Null

# 1. Audit active and recent mailbox export requests (exfiltration indicator)
Write-Host "[*] Auditing mailbox export requests..." -ForegroundColor Cyan
try {
    $exports = Get-MailboxExportRequest | Get-MailboxExportRequestStatistics
    $exports | Export-Csv "$reportDir\MailboxExportRequests.csv" -NoTypeInformation
    if ($exports) {
        Write-Host "[!] ALERT: $($exports.Count) mailbox export request(s) found. Review $reportDir\MailboxExportRequests.csv for unauthorized exports." -ForegroundColor Red
    } else {
        Write-Host "[+] No mailbox export requests found." -ForegroundColor Green
    }
} catch { Write-Host "[-] Export request audit skipped: $($_.Exception.Message)" -ForegroundColor Yellow }

# 2. Search for PST staging files in common exfiltration locations
Write-Host "[*] Scanning for staged PST/archive files..." -ForegroundColor Cyan
$stagingPaths = @('C:\Users','C:\ProgramData','C:\Windows\Temp','C:\Temp')
$staged = Get-ChildItem -Path $stagingPaths -Recurse -Include *.pst,*.7z,*.rar -ErrorAction SilentlyContinue |
          Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
          Select-Object FullName, Length, LastWriteTime
$staged | Export-Csv "$reportDir\StagedFiles.csv" -NoTypeInformation
if ($staged) { Write-Host "[!] ALERT: Potential staged exfiltration files found. Review $reportDir\StagedFiles.csv" -ForegroundColor Red }

# 3. Detect unauthorized VPN/tunneling software (persistence indicator)
Write-Host "[*] Checking for VPN/tunneling software..." -ForegroundColor Cyan
$vpnPatterns = 'openvpn|wireguard|tailscale|zerotier|softether|forticlient|anyconnect|GlobalProtect'
$rogueVpn = Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*,
                               HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue |
            Where-Object { $_.DisplayName -match $vpnPatterns } |
            Select-Object DisplayName, DisplayVersion, Publisher, InstallDate
$rogueVpn | Export-Csv "$reportDir\VpnSoftware.csv" -NoTypeInformation
if ($rogueVpn) { Write-Host "[!] ALERT: VPN software detected on a server. Validate against your approved software list." -ForegroundColor Red }

# 4. Review local admin group membership for unauthorized additions
Write-Host "[*] Enumerating local administrators..." -ForegroundColor Cyan
Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue |
    Select-Object Name, ObjectClass, PrincipalSource |
    Export-Csv "$reportDir\LocalAdmins.csv" -NoTypeInformation
Write-Host "[+] Local admin membership exported to $reportDir\LocalAdmins.csv - review for unauthorized accounts." -ForegroundColor Green

# 5. Hardening: confirm legacy auth posture and audit log verbosity
Write-Host "[*] Checking PowerShell Script Block Logging (required for exfil detection)..." -ForegroundColor Cyan
$sbl = Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -ErrorAction SilentlyContinue
if (-not $sbl -or $sbl.EnableScriptBlockLogging -ne 1) {
    New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Force | Out-Null
    Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name 'EnableScriptBlockLogging' -Value 1
    Write-Host "[+] Script Block Logging enabled." -ForegroundColor Green
} else { Write-Host "[+] Script Block Logging already enabled." -ForegroundColor Green }

Write-Host "`n[*] Audit complete. Report directory: $reportDir" -ForegroundColor Cyan
Write-Host "[!] NEXT STEPS: Reset credentials for any account involved in spray success; enforce MFA on all OWA/EWS access; block legacy authentication at the IdP." -ForegroundColor Yellow