THREATNOIR
Subscribe
MITRE ATT&CK · T1114

Email Collection

MITRE · cited in 7 of our lessons

Explanation

What attackers do. Attackers collect email from mailboxes, mail servers or through forwarding rules to gather sensitive information or monitor conversations, often to support fraud. This serves the Collection tactic.

How to defend. Enable mailbox audit logging, block automatic forwarding to external addresses, and review mailbox rules and delegated access. Protect mail access with MFA and conditional access, and restrict applications that can read mail through APIs. Restrict delegated mailbox access and export permissions to the few administrators who need them, and review them periodically.

Signs to look for. Look for new forwarding rules, inbox rules that hide or delete messages, bulk mailbox access through APIs, and mail access from unusual locations. A common gap is not reviewing third-party applications that have been granted mailbox access.

Open the technique on MITRE ATT&CK
The official text
Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.