Vendor: Microsoft

Product: Sysmon

Use-Case: Data Leak

Rules	Models	MITRE ATT&CK® TTPs	Event Types	Parsers
1	0	1	1	1

Event Type	Rules	Models
file-write	T1114.001 - T1114.001 ↳ FA-Outlook-pst: A file ends with either pst or ost