Udm Mail Raw Ip Https
This rule detects network connections made by processes commonly associated with mail collection, archiving, or data export (e.g., mail, archive, collector, export, rclone, winscp, curl executables). The detection specifically looks for these processes making HTTPS connections where the command line contains keywords related to email data files (.pst, .ost) or email processing (aspose.email, mailbox). The rule aims to identify potential exfiltration or collection of email data over HTTPS.
YARA-L
