Windows PowerShell Script Accessing Windows MailApp MailBox Data Path
Identifies PowerShell scripts referencing the Windows MailApp mailbox data path, which may indicate email data access or manipulation.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2023-07-08
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies PowerShell scripts whose contents reference the Windows MailApp Unistore mailbox data directory. Accessing these stored mailbox files can enable attackers to view, manipulate, exfiltrate, or delete user email content. The detection relies on PowerShell script block text containing a specific mailbox data path fragment.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Script Accessing Windows MailApp MailBox Data Path
id: 4b42fbf8-79d1-4b0d-a920-e6bb846fac7f
status: test
description: This rule identifies PowerShell scripts whose contents reference the Windows MailApp Unistore mailbox data directory. Accessing these stored mailbox files can enable attackers to view, manipulate, exfiltrate, or delete user email content. The detection relies on PowerShell script block text containing a specific mailbox data path fragment.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1070.008/T1070.008.md
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_mailbox_access.yml
author: frack113, Huntrule Team
date: 2023-07-08
tags:
- attack.stealth
- attack.t1070.008
- detection.threat-hunting
logsource:
product: windows
category: ps_script
definition: bade5735-5ab0-4aa7-a642-a11be0e40872
detection:
selection:
ScriptBlockText|contains: \Comms\Unistore\data
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 4e485d01-e18a-43f6-a46b-ef20496fa9d3
type: derived