SYSTEM-Context PST or OST Collection
This rule detects suspicious access to Outlook data files (.pst or .ost) by processes running in the SYSTEM context, excluding legitimate Outlook-related processes. It focuses on identifying non-standard applications or scripts attempting to collect mailbox data, potentially indicating data exfiltration or unauthorized access. The rule leverages causality fields for enhanced investigation.
Cortex XDR
