Elastic low stable eql

Accessing Outlook Data Files

Identifies commands containing references to Outlook data files extensions, which can potentially indicate the search, access, or modification of these files.

View Source

Detection Logic

process where host.os.type == "windows" and event.type == "start" and process.args : ("*.ost", "*.pst") and
  not process.name : "outlook.exe" and
  not (
        process.name : "rundll32.exe" and
        process.args : "*davclnt.dll,DavSetCookie*"
  )

Field Validations

Loading…

Comments (0)

Loading comments...