PowerShell Local Email Collection via Outlook COM Automation on Windows

title: PowerShell Local Email Collection via Outlook COM Automation on Windows
id: 90f6afdc-009d-454c-b0fa-b68e0e7fc7e6
status: test
description: This rule identifies PowerShell script content that references Outlook COM automation and local inbox-related scripts, such as Get-Inbox.ps1 and Microsoft.Office.Interop.Outlook usage. Attackers may use this pattern to collect sensitive email data stored on a local system (for example, inbox or Outlook-derived data). It relies on PowerShell script block telemetry that records the executed script text containing these Outlook-related identifiers.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1114.001/T1114.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_mail_acces.yml
author: frack113, Huntrule Team
date: 2021-07-21
modified: 2022-12-25
tags:
  - attack.collection
  - attack.t1114.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - Get-Inbox.ps1
      - Microsoft.Office.Interop.Outlook
      - Microsoft.Office.Interop.Outlook.olDefaultFolders
      - -comobject outlook.application
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 2837e152-93c8-43d2-85ba-c3cd3c2ae614
    type: derived