Windows PowerShell Script Block Local Email Collection via Outlook COM Automation
Flags PowerShell script block text referencing Outlook COM automation used to collect locally stored email.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-07-21
- Updated
- 2026-07-31
ATT&CK techniques
CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script block content that indicates local email collection using Outlook automation. It matches references to Outlook COM interop and specific inbox-related scripts (e.g., Get-Inbox.ps1), which can be used to access local Outlook storage or cached email data for collection. The detection relies on Script Block Logging telemetry that records the PowerShell script text executed on the host.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Script Block Local Email Collection via Outlook COM Automation
id: 90f6afdc-009d-454c-b0fa-b68e0e7fc7e6
status: test
description: This rule flags PowerShell script block content that indicates local email collection using Outlook automation. It matches references to Outlook COM interop and specific inbox-related scripts (e.g., Get-Inbox.ps1), which can be used to access local Outlook storage or cached email data for collection. The detection relies on Script Block Logging telemetry that records the PowerShell script text executed on the host.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1114.001/T1114.001.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_mail_acces.yml
author: frack113, Huntrule Team
date: 2021-07-21
modified: 2022-12-25
tags:
- attack.collection
- attack.t1114.001
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains:
- Get-Inbox.ps1
- Microsoft.Office.Interop.Outlook
- Microsoft.Office.Interop.Outlook.olDefaultFolders
- -comobject outlook.application
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 2837e152-93c8-43d2-85ba-c3cd3c2ae614
type: derived