T1114 · Email Collection

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1114 · Email Collection · Sunturai

attack-patternenterprise-attackT1114

Email Collection

attack-pattern--1608f3e1-598a-42f4-a01a-2e252e81728f

Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses.(Citation: TrustedSec OOB Communications) (Citation: CISA AA20-352A 2021) Adversaries can collect or forward email from mail servers or clients.

Created: May 31, 2017, 9:31 PM UTC
Modified: Oct 24, 2025, 5:48 PM UTC

3 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

48 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
New ActiveSyncAllowedDeviceID Added via PowerShell	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
PowerShell Mailbox Collection Script	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Exchange Mailbox Export via PowerShell	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Exporting Exchange Mailbox via PowerShell	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Inter-Process Communication via Outlook	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
M365 Exchange Mail Flow Transport Rule Created	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
M365 Exchange Inbox Forwarding Rule Created	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
M365 Exchange Mailbox Accessed by Unusual Client	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
M365 Exchange Mailbox Items Accessed Excessively	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Google Workspace Gmail Routing or Forwarding Rule Created or Modified	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Microsoft Graph Email Access by Unusual User and Client	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Top Internal Users Auto-forwarding Email Externally (Mailbox Rule and SMTP)	Unknown	Microsoft Sentinel analytics	Sep 4, 2026	MIT License
Top External Recipients Receiving Auto-forwarded Email (Mailbox Rule and SMTP)	Unknown	Microsoft Sentinel analytics	Sep 4, 2026	MIT License
Top External Domains Receiving Auto-forwarded Email (Mailbox Rule and SMTP)	Unknown	Microsoft Sentinel analytics	Sep 4, 2026	MIT License
Automatic External Email Forwarding Overview by Type (Mailbox Rule and SMTP)	Unknown	Microsoft Sentinel analytics	Sep 4, 2026	MIT License
NRT Multiple users email forwarded to same destination	Medium	Microsoft Sentinel analytics	Sep 2, 2026	MIT License
High risk Office operation conducted by IP Address that recently attempted to log into a disabled account	Medium	Microsoft Sentinel analytics	Sep 2, 2026	MIT License
Host Exporting Mailbox and Removing Export	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Threat Essentials - Mail redirect via ExO transport rule	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Mimecast Targeted Threat Protection - Impersonation Protect	High	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Mimecast Secure Email Gateway - Impersonation Protect	High	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Mimecast Secure Email Gateway - Attachment Protect	High	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Mimecast Targeted Threat Protection - Impersonation Protect	High	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Mimecast Secure Email Gateway - Impersonation Protect	High	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Mimecast Secure Email Gateway - Attachment Protect	High	Microsoft Sentinel analytics	Sep 1, 2026	MIT License

Showing 25 of 48

Filter in the catalogue

External references

mitre-attackT1114Open reference

CISA AA20-352A 2021Open reference

Microsoft Tim McMichael Exchange Mail Forwarding 2Open reference

TrustedSec OOB CommunicationsOpen reference

Platforms

LinuxmacOSOffice SuiteWindows

Kill chain phases

collection

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object