Mailbox Collection Utility Connecting to a Raw IP Without a Hostname
Detects a non-browser mailbox collection or archive utility connecting directly to an IP address while RemoteUrl is empty. This behavior is suspicious as legitimate email clients typically use hostnames. The rule filters out common browsers and svchost.exe and looks for keywords in the command line indicative of mailbox or archive activity (e.g., .pst, .ost, Aspose.Email, mailbox, archive). This suggests an attempt to exfiltrate or collect email data, potentially bypassing DNS resolution for C2 or evasion.
Microsoft Sentinel (KQL)
