Mailbox archiving is a great way to optimize and organize storage. It allows one to effectively manage their inbox to create a clean, secure, and compliant email environment.
Try in Splunk Security Cloud
Description
- Type: Anomaly
Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- Last Updated: 2024-05-27
- Author: Teoderick Contreras, Splunk
- ID: 74c5a3b0-27a7-463c-9d00-1a5bb12cb7b5
Annotations
ATT&CK
ATT&CK
| ID | Technique | Tactic |
|---|---|---|
| T1560 | Archive Collected Data | Collection |
Kill Chain Phase
- Exploitation
NIST
- DE.AE
CIS20
- CIS 10
CVE
Search
1
2
3
4
5
6
7
`powershell` EventCode=4104 ScriptBlockText = "*Compress-Archive*" ScriptBlockText = "*\\Temp\\*"
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
| rename Computer as dest
| rename UserID as user
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_archive_collected_data_via_powershell_filter`
Macros
Required fields
List of fields required to use this analytic.
- _time
- EventCode
- ScriptBlockText
- dest
- user
- Score
How To Implement
Known False Positives
powershell may used this function to archive data.
Associated Analytic Story
RBA
| Risk Score | Impact | Confidence | Message |
|---|---|---|---|
| 49.0 | 70 | 70 | Windows Archive Collected Data via Powershell on $dest$. |
Reference
Test Dataset
Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
I need to create an archive of a folder with certain subfolders (having some folders/files excluded) in PowerShell using compress-archive command.
For example, here is a folder structure:
c:\Temp\Folder
log1.log
log1_1.txt
c:\Temp\Folder\Folder1\
log2.log
log2_1.log
c:\Temp\Folder\Folder2\
log3.log
log3_1.logc:\Temp\Folder
log1.log
log1_1.txt
c:\Temp\Folder\Folder1\
log2.log
log2_1.logCompress-Archive Error: Cannot access the file because it is being used by another process
Here is a script:
Copy-Item -Path "c:\temp\folder\*" -Exclude "Folder2" -Force -PassThru | Compress-Archive -DestinationPath c:\temp1\archive.zipHowever, only “c:\Temp\Folder” folder files are being included in the archive:
log1.log
log1_1.txtUsing -recurse (in Copy-Item) does include the files from Folder1, but does not keep Folder1 in the archive. So I am getting all the files from the subfolder inside archive.zip, which is not what I need.
I need the below structure of archive.zip:
log1.log
log1_1.txt
Folder1\
log2.log
log2_1.logI tried using get-Item / get-child-Item and pipe it to copy-item – no luck – getting all files from the subfolders without folders name.
I figured out out that if I run the command below:
Copy-Item -Path "c:\temp\folder\folder1" -Force -PassThru -Recurse | Compress-Archive -DestinationPath c:\temp1\archive.zipIt creates and archive file with the below files/folders:
log2.log
log2_1.log
Folder1\
log2.log
log2_1.logSo after I deleted archive.zip and ran initial command – it is working as expected even after client reboot.
Copy-Item -Path "c:\temp\folder\*" -Exclude "Folder2" -Force -PassThru | Compress-Archive -DestinationPath c:\temp1\archive.zipThe content of zip file:
log1.log
log1_1.txt
Folder1\
log2.log
log2_1.logI’ve tried it on different windows clients: win2012/2016/2019 same behavior.
Not sure why this is happening.
How to get it working properly?
Appreciate your time!
Why is Mailbox Archiving Important?
Mailbox archiving is a crucial element of managing an email and inbox. It’s vital to ensure and maintain a secure and clutter-free environment in the inbox. Here are a couple of the main reasons why mailbox archiving matters:
Over the years, inboxes can become incredibly cluttered and full of emails that you don’t need. This can be especially troublesome when you need to find something. Archiving optimizes your email storage by moving older or less frequently accessed emails to a secure archive, reducing the load on the primary inbox.
Compliance and Legal Requirements: Many industries, businesses, and professions have regulations that require you to retain certain communications for a specific period of time. Mailbox archiving assists individuals and organizations in maintaining compliance with these legal requirements.
What are the Licensing Requirements for Mailbox Archiving?
When it comes to Microsoft 365, Exchange Online, and PowerShell, mailbox archiving might come with different licensing requirements. Depending on your Microsoft 365 plan, certain archiving features might be included, while others might require additional licensing.
An organization should check its licensing agreements to verify if mailbox archiving features are included.
How Can You Use Mailbox Archiving?
Mailbox archiving has various scenarios of usage, such as these:
Efficient Email Management: Archiving keeps the main mailbox focused on current and important emails so that one can access and reply to relevant communications in a timely manner.
Historical Data Access: With mailbox archiving, old emails are stored in a secure location so that one can access them without cluttering your primary inbox. This is especially useful when you
need to reference past communications.
How to Use PowerShell to Configure Mailbox Archiving in Exchange Online
Let’s break down how you can configure mailbox archiving in Exchange Online using PowerShell:
Click on the PowerShell icon to launch the program so that you can configure your mailbox settings directly by coding.
Connect to Exchange Online
Connect to Exchange Online by typing the right code into PowerShell:


