GreenBlood Outlook PST/OST Email File Access by Non-Mail Process
Detects GreenBlood ransomware or similar threats accessing Outlook PST/OST/EML/MSG email files from non-Outlook processes, potentially indicating data theft for double extortion. The rule specifically looks for file read, access, or creation actions on these email file types within common Outlook or user data folders, excluding legitimate processes that typically interact with these files.
Microsoft Sentinel (KQL)
