Detect Local Email Collection in Google Chronicle

rule t1114_001_local_email_collection {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects local Outlook PST/OST email collection via file access by non-Outlook processes, staging in suspicious directories, or command-line copy operations targeting email stores"
    mitre_attack_technique = "T1114.001"
    mitre_attack_tactic = "Collection"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1114/001/"
    created = "2026-04-18"
    version = "1.0"

  events:
    (
      // Branch 1: Non-Outlook process accessing PST/OST in Outlook directories
      (
        $e1.metadata.event_type = "FILE_OPEN" OR
        $e1.metadata.event_type = "FILE_CREATION" OR
        $e1.metadata.event_type = "FILE_COPY"
      ) AND
      (
        $e1.target.file.full_path = /(?i)\.(pst|ost)$/
      ) AND
      (
        $e1.target.file.full_path = /(?i)(AppData\\Local\\Microsoft\\Outlook|Documents\\Outlook Files)/
      ) AND
      NOT $e1.principal.process.file.full_path = /(?i)(outlook\.exe|msoia\.exe|ocpubmgr\.exe|olk\.exe|searchindexer\.exe|searchprotocolhost\.exe|msosync\.exe)$/
    )
    OR
    (
      // Branch 2: PST/OST staged outside Outlook directories in suspicious paths
      (
        $e1.metadata.event_type = "FILE_CREATION" OR
        $e1.metadata.event_type = "FILE_COPY"
      ) AND
      $e1.target.file.full_path = /(?i)\.(pst|ost)$/ AND
      NOT $e1.target.file.full_path = /(?i)(AppData\\Local\\Microsoft\\Outlook|Documents\\Outlook Files)/ AND
      (
        $e1.target.file.full_path = /(?i)(\\Windows\\Temp|\\Temp\\|\\Downloads\\|\\Public\\|\\ProgramData\\|\\AppData\\Roaming\\|\\Users\\Public\\)/
      )
    )
    OR
    (
      // Branch 3: Command-line process referencing PST/OST with copy/exfil verbs
      $e1.metadata.event_type = "PROCESS_LAUNCH" AND
      $e1.principal.process.file.full_path = /(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|xcopy\.exe|robocopy\.exe|wmic\.exe|forfiles\.exe)$/ AND
      $e1.target.process.command_line = /(?i)\.(pst|ost)/ AND
      (
        $e1.target.process.command_line = /(?i)(\bcopy\b|xcopy|robocopy|Compress-Archive|Invoke-WebRequest|\bcurl\b|wmic.*process.*call|\bmove\b)/
      )
    )

  condition:
    $e1
}