huntrule

Windows PowerShell Script Block Local Email Collection via Outlook COM Automation

Flags PowerShell script block text referencing Outlook COM automation used to collect locally stored email.

FreeReviewedSigma · Medium · v2
Product
windows
Category
ps_script
Author
frack113 (SigmaHQ), DRL 1.1
Published
2021-07-21
Updated
2026-07-31
AnalysisDetection
title: Windows PowerShell Script Block Local Email Collection via Outlook COM Automation
id: 90f6afdc-009d-454c-b0fa-b68e0e7fc7e6
status: test
description: This rule flags PowerShell script block content that indicates local email collection using Outlook automation. It matches references to Outlook COM interop and specific inbox-related scripts (e.g., Get-Inbox.ps1), which can be used to access local Outlook storage or cached email data for collection. The detection relies on Script Block Logging telemetry that records the PowerShell script text executed on the host.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1114.001/T1114.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_mail_acces.yml
author: frack113, Huntrule Team
date: 2021-07-21
modified: 2022-12-25
tags:
  - attack.collection
  - attack.t1114.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - Get-Inbox.ps1
      - Microsoft.Office.Interop.Outlook
      - Microsoft.Office.Interop.Outlook.olDefaultFolders
      - -comobject outlook.application
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 2837e152-93c8-43d2-85ba-c3cd3c2ae614
    type: derived