Local mail store referenced by a shell or archiving utility

Siemphony@siemphonymediumT1114.001unverified

Matches process creation where an interpreter, copy tool or archiver is launched with a command line naming a local Outlook data file or the directories those files live in. The mail client itself opens its own .ost without ever putting the path on a command line, so the pairing of a general-purpose utility in Image with a mail-store path in CommandLine is what carries the signal — this is the command-line-tooling half of MITRE's AN0130. The rest of the described chain, file access followed by staging and network transfer inside a TimeWindow, needs a join Sigma cannot express, so only the single-event tooling step is authored here. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0047, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\wmic.exe" or FolderPath endswith "\\robocopy.exe" or FolderPath endswith "\\xcopy.exe" or FolderPath endswith "\\esentutl.exe" or FolderPath endswith "\\certutil.exe" or FolderPath endswith "\\forfiles.exe" or FolderPath endswith "\\tar.exe" or FolderPath endswith "\\curl.exe" or FolderPath endswith "\\7z.exe" or FolderPath endswith "\\rar.exe" or FolderPath endswith "\\winrar.exe") and (ProcessCommandLine contains ".ost" or ProcessCommandLine contains ".pst" or ProcessCommandLine contains "\\Microsoft\\Outlook" or ProcessCommandLine contains "\\Documents\\Outlook Files"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cmd.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\wmic.exe" OR Image="*\\robocopy.exe" OR Image="*\\xcopy.exe" OR Image="*\\esentutl.exe" OR Image="*\\certutil.exe" OR Image="*\\forfiles.exe" OR Image="*\\tar.exe" OR Image="*\\curl.exe" OR Image="*\\7z.exe" OR Image="*\\rar.exe" OR Image="*\\winrar.exe") AND (CommandLine="*.ost*" OR CommandLine="*.pst*" OR CommandLine="*\\Microsoft\\Outlook*" OR CommandLine="*\\Documents\\Outlook Files*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wmic.exe" OR TO_LOWER(process.executable) LIKE "*\\\\robocopy.exe" OR TO_LOWER(process.executable) LIKE "*\\\\xcopy.exe" OR TO_LOWER(process.executable) LIKE "*\\\\esentutl.exe" OR TO_LOWER(process.executable) LIKE "*\\\\certutil.exe" OR TO_LOWER(process.executable) LIKE "*\\\\forfiles.exe" OR TO_LOWER(process.executable) LIKE "*\\\\tar.exe" OR TO_LOWER(process.executable) LIKE "*\\\\curl.exe" OR TO_LOWER(process.executable) LIKE "*\\\\7z.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rar.exe" OR TO_LOWER(process.executable) LIKE "*\\\\winrar.exe") AND (TO_LOWER(process.command_line) LIKE "*.ost*" OR TO_LOWER(process.command_line) LIKE "*.pst*" OR TO_LOWER(process.command_line) LIKE "*\\\\microsoft\\\\outlook*" OR TO_LOWER(process.command_line) LIKE "*\\\\documents\\\\outlook files*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$|\\cmd\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\wmic\.exe$|\\robocopy\.exe$|\\xcopy\.exe$|\\esentutl\.exe$|\\certutil\.exe$|\\forfiles\.exe$|\\tar\.exe$|\\curl\.exe$|\\7z\.exe$|\\rar\.exe$|\\winrar\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(\.ost|\.pst|\\Microsoft\\Outlook|\\Documents\\Outlook Files)</field>    <description>Local mail store referenced by a shell or archiving utility</description>    <mitre>      <id>T1114.001</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: data_staging_exfil
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 7e159d0c-6a34-4b82-bf47-91d3c05ea268

ATT&CKT1114.001

T1114.001Local Email Collection

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

A process creation event where a general-purpose utility is launched with an Outlook mail-store path on its command line. Not Outlook reading its own mailbox — Outlook opens its .ost through the file API and never puts the path in a command line. It is the pairing that carries the signal: robocopy.exe or 7z.exe naming .pst is someone treating the mailbox as a file to be moved. MITRE's AN0130 describes a four-step chain: directory enumeration, file access, optional compression or staging, then network transfer. Sigma cannot join across events, so only the command-line-tooling step is authored here. The file-access leg — Security 4663 and Sysmon EventID 11, both offered in the brief — is what would make the detection independent of which binary was used. It is not authored, and that gap is the rule's biggest limitation.

02 · Telemetry you need

Sysmon EventID 1, or Security 4688 with Audit Process Creation and
User and IntegrityLevel are real fields on Sysmon EventID 1. The rule does

03 · How the logic works

Two selections, ANDed, each on one field:

Image|endswith with a leading backslash anchors on the path separator, so \7z.exe does not match not7z.exe. Note the direction: the tool half is on Image, the target half on CommandLine. That is deliberate — the utility's identity is in the image name, and the mailbox is only ever an argument. The seventeen names are the rule's entire recall surface. They are the author's list, not MITRE's — MITRE names the ProcessAllowList knob, which is the inverse (things to suppress). Anything not on the list is invisible: an implant reading the .ost in its own process emits no process creation at all; 7za.exe, a renamed archiver, Copy-Item typed into an already-running PowerShell host, or a drag in Explorer all escape. `.ost` and `.pst` are unanchored four-character substrings. The Splunk render is literally CommandLine="*.ost*". curl.exe https://cdn.ostrich.example/pkg contains .ost and matches. So does any GUID fragment or URL carrying those characters. That is a real false-positive class on any build or admin host. Scope drift worth knowing: curl.exe and certutil.exe with a .pst argument are the transfer stage — T1048/T1567/T1105 — not local collection. A hit on those two is tagged attack.collection and will mis-route triage.

04 · Common false positives

Backup and endpoint-archiving agents shelling out to robocopy.exe or
Mailbox migration and profile-roaming scripts inventorying .pst files.
Storage-reporting jobs running Get-ChildItem -Filter *.ost, which match on
Anything whose URL or argument merely contains the literal .ost/.pst.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0047, never executed against a log line. level: medium is a judgement, not a measurement.
tier_2: means running it over history, seeing how much of the volume is the unanchored .ost collision, and naming the backup agents by parent.
tier_3: means adding the 4663/Sysmon-11 file-access leg so the detection stops depending on a list of seventeen binaries. Until then, know the evasion: robocopy %LOCALAPPDATA%\Microsoft C:\stage /S takes the .ost with everything else and puts neither .ost nor \Microsoft\Outlook on the command line.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Anchor the extensions first: require \Microsoft\Outlook or \Outlook Files
Populate MITRE's ProcessAllowList knob by parent process, not by
MITRE's UserContext knob attaches to User/IntegrityLevel; no default is
TimeWindow (file access → staging → transfer) belongs in your platform's

Declared by the author

Backup and endpoint-archiving agents that shell out to robocopy.exe or 7z.exe across the user profile and name the .pst path on the command line. These are exactly MITRE's ProcessAllowList knob, and the allowlist should key on the parent process rather than on the utility, since the utility name is the same one an operator would use.
Mailbox migration and profile-roaming scripts that inventory or relocate .pst files, typically as an administrator or a service account. MITRE's UserContext knob exists for this — the accounts that touch mail stores in bulk during a migration are a small, nameable set.
Scheduled storage-reporting or compliance tooling running Get-ChildItem -Filter *.ost over user home directories, which matches on the extension alone with no access to the file contents at all.
Support scripts that repair a corrupt data file with esentutl.exe or copy it aside before running the inbox repair tool, a benign sequence that looks identical to staging.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1114.001, evaluated against their process_creation events.

Share this rule

/u/siemphony/7e159d0c-6a34-4b82-bf47-91d3c05ea268

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Local mail store referenced by a shell or archiving utility

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it