huntrule

Windows PowerShell Script Access to Windows MailApp Mailbox Data Paths

Identifies PowerShell scripts referencing the Windows MailApp mailbox data path, which may indicate email data access or manipulation.

FreeUnreviewedSigmamediumv1
title: Windows PowerShell Script Access to Windows MailApp Mailbox Data Paths
id: 4b42fbf8-79d1-4b0d-a920-e6bb846fac7f
status: test
description: This rule flags PowerShell script content that references the Windows MailApp mailbox data location (\Comms\Unistore\data). Accessing this path is significant because it can indicate attempts to manipulate, read, or remove stored email data on the user’s device. The detection relies on telemetry that records the PowerShell ScriptBlock text and matches the specified path substring.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1070.008/T1070.008.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_mailbox_access.yml
author: frack113, Huntrule Team
date: 2023-07-08
tags:
  - attack.stealth
  - attack.t1070.008
  - detection.threat-hunting
logsource:
  product: windows
  category: ps_script
  definition: bade5735-5ab0-4aa7-a642-a11be0e40872
detection:
  selection:
    ScriptBlockText|contains: \Comms\Unistore\data
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 4e485d01-e18a-43f6-a46b-ef20496fa9d3
    type: derived

What it detects

This rule flags PowerShell script content that references the Windows MailApp mailbox data location (\Comms\Unistore\data). Accessing this path is significant because it can indicate attempts to manipulate, read, or remove stored email data on the user’s device. The detection relies on telemetry that records the PowerShell ScriptBlock text and matches the specified path substring.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.