Email Collection

T1114

Technique with 3 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients.

Detection rules35

Rules on DetectionCode tagged with T1114 or one of its sub-techniques.

Sigma7

Rule	Level	Log source	Technique
Exchange PowerShell Snap-Ins Usage	high	windows / process_creation	T1114
Hacktool Ruler	high	windows / NULL	T1114
Suspicious Inbox Forwarding Identity Protection	high	azure / NULL	T1114.003
Google Workspace Out Of Domain Email Forwarding	medium	gcp / NULL	T1114.003
Powershell Local Email Collection	medium	windows / ps_script	T1114.001
PST Export Alert Using eDiscovery Alert	medium	m365 / NULL	T1114
PST Export Alert Using New-ComplianceSearchAction	medium	m365 / NULL	T1114

Splunk28

Rule	Type	Risk	Data source	Technique
Email files written outside of the Outlook directory	Anomaly	NULL	Sysmon EventID 11	T1114.001
Email servers sending high volume traffic to hosts	Anomaly	NULL		T1114.002
Hosts receiving high volume of network traffic from email server	Anomaly	NULL		T1114.002
Mailsniper Invoke functions	TTP	NULL	Powershell Script Block Logging 4104	T1114.001
O365 Compliance Content Search Exported	TTP	NULL		T1114.002
O365 Compliance Content Search Started	TTP	NULL		T1114.002
O365 Email Access By Security Administrator	TTP	NULL	Office 365 Universal Audit Log	T1114.002
O365 Email New Inbox Rule Created	Anomaly	NULL	Office 365 Universal Audit Log	T1114.003
O365 Email Password and Payroll Compromise Behavior	TTP	NULL	Office 365 Universal Audit Log, Office 365 Reporting Message Trace	T1114.001
O365 Email Receive and Hard Delete Takeover Behavior	Anomaly	NULL	Office 365 Universal Audit Log, Office 365 Reporting Message Trace	T1114.001
O365 Email Send and Hard Delete Exfiltration Behavior	Anomaly	NULL	Office 365 Universal Audit Log, Office 365 Reporting Message Trace	T1114.001
O365 Email Send and Hard Delete Suspicious Behavior	Anomaly	NULL	Office 365 Universal Audit Log	T1114.001
O365 Email Suspicious Behavior Alert	TTP	NULL	Office 365 Universal Audit Log	T1114.003
O365 Email Suspicious Search Behavior	Anomaly	NULL	Office 365 Universal Audit Log	T1114.002
O365 Email Transport Rule Changed	Anomaly	NULL	Office 365 Universal Audit Log	T1114.003
O365 Mailbox Email Forwarding Enabled	TTP	NULL		T1114.003
O365 Mailbox Inbox Folder Shared with All Users	TTP	NULL	O365 ModifyFolderPermissions	T1114.002
O365 Mailbox Read Access Granted to Application	TTP	NULL	O365 Update application.	T1114.002
O365 Multiple Mailboxes Accessed via API	TTP	NULL	O365 MailItemsAccessed	T1114.002
O365 New Email Forwarding Rule Created	TTP	NULL		T1114.003
O365 New Email Forwarding Rule Enabled	TTP	NULL		T1114.003
O365 New Forwarding Mailflow Rule Created	TTP	NULL		T1114
O365 OAuth App Mailbox Access via EWS	TTP	NULL	O365 MailItemsAccessed	T1114.002
O365 OAuth App Mailbox Access via Graph API	TTP	NULL	O365 MailItemsAccessed	T1114.002
O365 PST export alert	TTP	NULL	O365	T1114
O365 Suspicious Admin Email Forwarding	Anomaly	NULL		T1114.003
O365 Suspicious Rights Delegation	TTP	NULL		T1114.002
O365 Suspicious User Email Forwarding	Anomaly	NULL		T1114.003

Sub-techniques3

ID	Name	Examples
T1114.001	Local Email Collection	20
T1114.002	Remote Email Collection	20
T1114.003	Email Forwarding Rule	5

Groups4

Software2

Emotet TRANSLATEXT

Campaigns0

None recorded.

Procedure examples6

Groups4

Used by	Procedure example
GroupEmber Bear	Ember Bear attempts to collect mail from accessed systems and servers. CISA GRU29155 2024 Cadet Blizzard emerges as novel threat actor
GroupMagic Hound	Magic Hound has compromised email credentials in order to steal sensitive data. Certfa Charming Kitten January 2021
GroupScattered Spider	Scattered Spider searched the victim’s Microsoft Exchange for emails about the intrusion and incident response. CISA Scattered Spider Advisory November 2023
GroupSilent Librarian	Silent Librarian has exfiltrated entire mailboxes from compromised accounts. DOJ Iran Indictments March 2018

Software2

Used by	Procedure example
MalwareEmotet	Emotet has been observed leveraging a module that can scrape email addresses from Outlook. Binary Defense Emotes Wi-Fi Spreader CIS Emotet Dec 2018 IBM IcedID November 2017
MalwareTRANSLATEXT	TRANSLATEXT has exfiltrated collected email addresses to the C2 server. Zscaler Kimsuky TRANSLATEXT

References2

CISA AA20-352A 2021 Open source
CISA. (2021, April 15). Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations. Retrieved August 30, 2024.
TrustedSec OOB Communications Open source
Tyler Hudak. (2022, December 29). To OOB, or Not to OOB?: Why Out-of-Band Communications are Essential for Incident Response. Retrieved August 30, 2024.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.