[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1114":3},{"item":4,"lessons":18,"controls":48,"related":77},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1114","T1114","Email Collection",7,"MITRE","**What attackers do.** Attackers collect email from mailboxes, mail servers or through forwarding rules to gather sensitive information or monitor conversations, often to support fraud. This serves the Collection tactic.\n\n**How to defend.** Enable mailbox audit logging, block automatic forwarding to external addresses, and review mailbox rules and delegated access. Protect mail access with MFA and conditional access, and restrict applications that can read mail through APIs. Restrict delegated mailbox access and export permissions to the few administrators who need them, and review them periodically.\n\n**Signs to look for.** Look for new forwarding rules, inbox rules that hide or delete messages, bulk mailbox access through APIs, and mail access from unusual locations. A common gap is not reviewing third-party applications that have been granted mailbox access.","Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1114\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44],{"slug":21,"title":22,"published_at":23},"china-linked-hackers-built-commercial-portal-to-resell-stolen-government-emails","China-Linked Hackers Built Commercial Portal to Resell Stolen Government Emails","2026-10-08T20:21:18.219+00:00",{"slug":25,"title":26,"published_at":27},"ai-powered-phishing-service-hijacks-12000-inboxes-for-financial-fraud","AI-Powered Phishing Service Hijacks 12,000 Inboxes for Financial Fraud","2026-09-23T21:22:19.011+00:00",{"slug":29,"title":30,"published_at":31},"ai-powered-phishing-platform-eviltokens-compromises-12000-email-accounts","AI-Powered Phishing Platform EvilTokens Compromises 12,000+ Email Accounts","2026-09-23T12:20:50.118+00:00",{"slug":33,"title":34,"published_at":35},"iranian-state-sponsored-hackers-steal-31tb-of-academic-data-via-credential-attacks","Iranian State-Sponsored Hackers Steal 31TB of Academic Data via Credential Attacks","2026-08-19T12:20:19.237+00:00",{"slug":37,"title":38,"published_at":39},"russian-apt-exploits-exchange-owa-zero-day-for-persistent-mailbox-access","Russian APT Exploits Exchange OWA Zero-Day for Persistent Mailbox Access","2026-07-30T00:20:22.903+00:00",{"slug":41,"title":42,"published_at":43},"russian-apt-exploits-zimbra-zero-day-to-silently-steal-emails-on-view","Russian APT Exploits Zimbra Zero-Day to Silently Steal Emails on View","2026-07-23T21:20:23.91+00:00",{"slug":45,"title":46,"published_at":47},"bec-as-a-service-platform-bypasses-mfa-and-manipulates-inboxes","BEC-as-a-Service Platform Bypasses MFA and Manipulates Inboxes","2026-07-01T12:21:35.027+00:00",[49,54,59,63,68,73],{"slug":50,"name":51,"problem":52,"stories":53},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",6,{"slug":55,"name":56,"problem":57,"stories":58},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",4,{"slug":60,"name":61,"problem":62,"stories":58},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":64,"name":65,"problem":66,"stories":67},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",2,{"slug":69,"name":70,"problem":71,"stories":72},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,{"slug":74,"name":75,"problem":76,"stories":72},"patch-management","Automated patch management","Known holes get closed in days, not months.",[78,83,88,93,98,102,106,110],{"family":79,"item":80,"code":81,"title":82,"together":9},"gdpr","32","Article 32","Security of processing",{"family":84,"item":85,"code":86,"title":87,"together":9},"nist-800-53","ac-17","AC-17","Remote Access",{"family":84,"item":89,"code":90,"title":91,"together":92},"ac-2","AC-2","Account Management",5,{"family":94,"item":95,"code":96,"title":97,"together":92},"cis","6","Control 6","Access Control Management",{"family":84,"item":99,"code":100,"title":101,"together":58},"si-4","SI-4","System Monitoring",{"family":79,"item":103,"code":104,"title":105,"together":58},"33","Article 33","Notification of a personal data breach to the supervisory authority",{"family":94,"item":107,"code":108,"title":109,"together":58},"13","Control 13","Network Monitoring and Defense",{"family":111,"item":112,"code":113,"title":114,"together":58},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring"]