PowerShell Local Email Collection via Outlook COM Objects

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•18

This rule detects PowerShell script blocks that contain keywords associated with collecting local email data, specifically targeting Microsoft Outlook. It looks for script names like 'Get-Inbox.ps1' or the use of Outlook COM objects ('Microsoft.Office.Interop.Outlook', 'Microsoft.Office.Interop.Outlook.olDefaultFolders', '-comobject outlook.application'). This activity is indicative of an adversary attempting to gather sensitive information from a user's local email client.