326. Adversaries Abuse XstExport to Exract Emails Before Exfiltration
Hello everyone! Espionage-focused adverasaries often show interest in emails. In some cases they can even read them before exfiltration. And they may need some tools to export them! According to this report , the adversary leveraged XstExport - a legitimate open source tool for exporting the content of Microsoft Outlook OST and PST files: XstExport.exe -e <email>@<domain>.ost2 You don't use it in your environment? Why not to hunt it! event_type: "processcreatewin" AND proc_file_productname: "XstExport" See you tomorrow!