Outlook OST File Accessed for Local Email Collection

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects when an Outlook OST (Offline Storage Table) file is accessed over SMB (Server Message Block) protocol. The detection is triggered by the presence of the string ".ost" (case-insensitive) in the network traffic on port 445 (SMB). This activity could indicate an attempt to collect local email data.