Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
22 detections
Filters
Last updated
All Time
Detection languages
10
8
2
1
1
Contributors
10
5
3
1
1
Categories
12
10
10
7
6
Platforms
16
5
2
1
1
Products / Services
17
8
2
2
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects PowerShell scripts attempting to access the default Windows Mail App mailbox data. This activity could indicate an adversary trying to manipulate, exfiltrate, or delete stored emails. The detection specifically looks for the string '\Comms\Unistore\data' within PowerShell script blocks, which points to the location where the Windows Mail App stores its data.
Page 2 of 2