SYSTEM-context PST or OST collection

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•7•1•7

This rule detects when a non-Outlook process running as SYSTEM accesses or creates PST or OST mailbox data files. The logic specifically excludes legitimate Outlook, searchindexer, or searchprotocolhost activity to focus on suspicious mailbox collection sequences.