Uncommon Process Access to Windows Outlook Mail Files

SigmaHQ Detections@sigmaHQ

•updated Jun 2, 2025•0•26

Detects file access requests to Windows Outlook Mail data files by uncommon processes. This could indicate a potential attempt to steal credentials or sensitive information from Outlook mailboxes. The rule requires significant baselining to reduce false positives.