System Mailbox Data File Access By Nonoutlook Process

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•0•0•1

Detects when a non-Outlook process running as SYSTEM accesses Outlook mailbox data files (.pst or .ost). This rule focuses on identifying suspicious access to sensitive email data outside of normal application behavior, retaining principal and target context for correlation.