General attempts to access local email store

Description

Use this query to find attempts to access files in the local path containing Outlook emails.

Query · kql

DeviceFileEvents
| where FolderPath hasprefix "EmailStorage"
| where FolderPath has "Outlook"
| project FileName, FolderPath, InitiatingProcessFileName,
InitiatingProcessCommandLine, DeviceId, Timestamp
Raw source General attempts to access local email store · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: c3e585d2-f1d0-4789-85a2-cdf7642fdf8b
name: General attempts to access local email store
description: |
  Use this query to find attempts to access files in the local path containing Outlook emails.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
tactics:
- Collection
query: |
  DeviceFileEvents
  | where FolderPath hasprefix "EmailStorage"
  | where FolderPath has "Outlook"
  | project FileName, FolderPath, InitiatingProcessFileName,
  InitiatingProcessCommandLine, DeviceId, Timestamp

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.