Outlook PST File Copied Locally via SMB

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects when a file with the ".pst" extension (Outlook Personal Storage Table file) is copied locally via the Server Message Block (SMB) protocol. This could indicate data exfiltration or unauthorized access to sensitive email archives.