BIOC
Informational
✕
Scripting process reads Outlook data files
Attackers may try to retrieve email data and sensitive information from .ost and .pst files.
- Module:
- Platform Analytics
- Agent event type:
- File
- Category:
- Collection
- Status:
- Enabled
ATT&CK tactics: Collection (TA0009)
ATT&CK techniques: Email Collection (T1114)
Indicator:
File file name = *.ost , *.pst AND action type = read Process initiated by = cscript.exe , wscript.exe , powershell.exe , mshta.exe , rundll32.exe , cmd.exe , cgo name = cscript.exe , wscript.exe , powershell.exe , mshta.exe , rundll32.exe , cmd.exe
Preventable: yes