Access of Outlook Email Archives¶
Collection of sensitive information via .ost and .pst outlook archive files.
id: | 15d87029-42c1-4992-a49b-aac74d451c06 |
---|---|
categories: | enrich |
confidence: | low |
os: | windows |
created: | 7/26/2019 |
updated: | 7/26/2019 |
MITRE ATT&CK™ Mapping¶
tactics: | Collection |
---|---|
techniques: | T1114 Email Collection |
Query¶
process where subtype.create and wildcard(command_line, "*.ost *", "*.pst *")