how would I detect and monitor processes and command-line arguments for actions that could be taken to gather local email files. For example, I want to be alerted if an adversary gathers or moves email files. Most email files have .eml, .pst, .ost extension. I thought about doing regex search for all the files ending with that extension. What do you think?