
title: Powershell Local Email Collection
author: frack113
date: 2021/07/21
description: Adversaries may target user email on local systems to collect sensitive
  information. Files containing email data can be acquired from a user’s local system,
  such as Outlook storage or cache files.
detection:
  SELECTION_1:
    ScriptBlockText:
    - '*Get-Inbox.ps1*'
    - '*Microsoft.Office.Interop.Outlook*'
    - '*Microsoft.Office.Interop.Outlook.olDefaultFolders*'
    - '*-comobject outlook.application*'
  condition: SELECTION_1
falsepositives:
- Unknown
id: 2837e152-93c8-43d2-85ba-c3cd3c2ae614
level: medium
logsource:
  category: ps_script
  definition: Script block logging must be enabled
  product: windows
modified: 2021/10/16
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1114.001/T1114.001.md
status: experimental
tags:
- attack.collection
- attack.t1114.001
ruletype: SIGMA
