Access of Outlook Email Archives¶
Collection of sensitive information via .ost and .pst outlook archive files.
| id: | 15d87029-42c1-4992-a49b-aac74d451c06 |
|---|---|
| categories: | enrich |
| confidence: | low |
| os: | windows |
| created: | 7/26/2019 |
| updated: | 7/26/2019 |
MITRE ATT&CK™ Mapping¶
| tactics: | Collection |
|---|---|
| techniques: | T1114 Email Collection |
Query¶
process where subtype.create and wildcard(command_line, "*.ost *", "*.pst *")