T1114.001 — Local Email Collection

Tactic: Collection · Platforms: Windows

Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files. Outlook stores data locally in offline data files with an extension of .ost. Outlook 2010 and later…

Sub-technique of Email Collection (T1114).

Sigma detection rules (1)

T1114.001 Email Collection: Local Email Collection

title: "T1114.001 Email Collection: Local Email Collection"
id: f3795537-4a9c-442e-aa9f-355b749832eb
description: 'Detects creation/copying of .pst/.ost files by a process other than Outlook. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: TargetFilePathPattern, TimeWindow, UserContext, ProcessAllowList.'
references:
  - https://attack.mitre.org/techniques/T1114/001
author: Shahrukh Khan
date: 2026-04-02
license: MIT
tags:
  - attack.collection
  - attack.t1114.001

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '11'
    TargetFilename|endswith:
      - '.pst'
      - '.ost'
  filter_outlook:
    Image|endswith: '\outlook.exe'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not 1 of filter_*

falsepositives:
  - Backup/migration tools legitimately copying mail data.

level: medium

Related sub-techniques

Explore