Email files written outside of the Outlook directory

name: Email files written outside of the Outlook directory
id: 8d52cf03-ba25-4101-aa78-07994aed4f74
version: 13
creation_date: '2020-04-29'
modification_date: '2026-07-02'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects email files (.pst or .ost) being created outside the standard Outlook directories.
    It leverages the Endpoint.Filesystem data model to identify file creation events and filters for email files not located in "C:\Users\*\My Documents\Outlook Files\*" or "C:\Users\*\AppData\Local\Microsoft\Outlook*".
    This activity is significant as it may indicate data exfiltration or unauthorized access to email data.
    If confirmed malicious, an attacker could potentially access sensitive email content, leading to data breaches or further exploitation within the network.
data_source:
    - Sysmon EventID 11
search: |-
    | tstats `security_content_summariesonly`
      count values(Filesystem.file_path) as file_path
            min(_time) as firstTime
            max(_time) as lastTime
    
    FROM datamodel=Endpoint.Filesystem WHERE
    
    Filesystem.action IN (
        "created",
        "modified"
    )
    Filesystem.file_name IN (
        "*.pst",
        "*.ost"
    )
    NOT Filesystem.file_path IN (
        "C:\\Users\\*\\My Documents\\Outlook Files\\*",
        "C:\\Users\\*\\AppData\\Local\\Microsoft\\Outlook*"
    )
    
    BY Filesystem.action Filesystem.dest Filesystem.file_access_time
       Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
       Filesystem.file_name Filesystem.file_path Filesystem.file_acl
       Filesystem.file_size Filesystem.process_guid Filesystem.process_id
       Filesystem.user Filesystem.vendor_product
    
    | `drop_dm_object_name("Filesystem")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `email_files_written_outside_of_the_outlook_directory_filter`
how_to_implement: To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes.
known_false_positives: |-
    Administrators and users sometimes prefer backing up their email data by moving the email files into a different folder. These attempts will be detected by the search.
    You should confirm that the activity is legitimate and modify the search to add exclusions, as necessary.
references: []
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A new email file [$file_name$] was written to [$file_path$] on endpoint $dest$ by user $user$.
analytic_story:
    - Collection and Staging
asset_type: Endpoint
mitre_attack_id:
    - T1114.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint