Scattered SpiderG1015 ↗
Searched the victim’s Microsoft Exchange for emails about the intrusion and incident response.1
tfMITRE ATT&CK technique
Email Collection T1114
- Tactic
- Collection
- Platforms
- Windows, macOS, Linux, Office Suite
- Version
- 2.6
- Created
- 31 May 2017
- Last modified
- 24 October 2025
- Contributors
- Swetha Prabakaran, Microsoft Threat Intelligence Center (MSTIC); Menachem Goldstein
Sub-techniques 336 rules across the family · 6 mapped directly to T1114 · 3 of 3 carry rules
Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses.[1][2] Adversaries can collect or forward email from mail servers or clients.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
4
Threat groups70th pct
Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.2
Tools & malware51st pct
Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.6
Detection rules67th pct
Detection rules67th percentile · 67% of ATT&CK techniques have this many detection rules written or fewer.Email Collection MITRE reference T1114
70th pctamong all ATT&CK techniques for number of groups
4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Ember BearG1003 ↗
Attempts to collect mail from accessed systems and servers.12
Silent LibrarianG0122 ↗
Has exfiltrated entire mailboxes from compromised accounts.1
Magic HoundG0059 ↗
Has compromised email credentials in order to steal sensitive data.1
All 4 groups for this technique
2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
TRANSLATEXTS1201 ↗
Has exfiltrated collected email addresses to the C2 server.1
EmotetS0367 ↗
Has been observed leveraging a module that can scrape email addresses from Outlook.123
All 2 software entries for this technique
Offense vs defense T1114
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 2
first rule: 2017 Q2Email Collection detection strategy DET0476
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Email Collection via Local Email Access and Auto-Forwarding Behavior
4 platforms
AN1309 · Windows
Correlates creation of email forwarding rules or header anomalies (e.g., X-MS-Exchange-Organization-AutoForwarded) with suspicious process execution, file access of .pst/.ost files, and network connections to external SMTP servers.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | WinEventLog:Application | Exchange logs or header artifacts |
| Command ExecutionDC0064 | WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
| Network Share AccessDC0102 | WinEventLog:Security | EventCode=5145 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Defines correlation window across email rule creation and outbound SMTP. |
| UserContext | Filters for admin or service accounts to reduce false positives. |
| SMTPDomainList | Allows tuning based on expected external email domains. |
AN1310 · Linux
Detects file access to mbox/maildir files in conjunction with curl/wget/postfix execution, or anomalous shell scripts harvesting user mail directories.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | linux:osquery | process_events |
| File AccessDC0055 | auditd:SYSCALL | open |
| Network Connection CreationDC0082 | linux:syslog | postfix/smtpd |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| WatchedMailDirs | Specify user mail directories (/var/mail, ~/Maildir) |
| ProcessNameList | Tune based on local mail clients or curl usage in environment |
| TimeWindow | Define how close together access and exfil events must occur |
AN1311 · macOS
Monitors Mail.app database or maildir file access, automation via AppleScript, and abnormal mail rule creation using scripting or UI automation frameworks.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | macos:unifiedlog | Mail or AppleScript subsystem |
| File AccessDC0055 | macos:endpointsecurity | es_event_open, es_event_exec |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ScriptProcessNameList | Script interpreters or automation tools (osascript, Automator, etc.) |
| WatchedMailFiles | Mail.app SQLite DB or .emlx directory |
AN1312 · Office Suite
Correlates unusual auto-forwarding rule creation via Exchange Web Services or Outlook rules engine, presence of X-MS-Exchange-Organization-AutoForwarded headers, and logon session anomalies from abnormal IPs.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | m365:exchange | MessageTrace logs |
| Command ExecutionDC0064 | m365:unified | Set-Mailbox, New-InboxRule |
| Logon Session CreationDC0067 | azure:ad | SignInEvents |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UserAgentList | Restrict rules from non-browser agents |
| ExternalSMTPDomainList | Allow listing for org-sanctioned forwarding domains |
| TimeWindow | Time delta between rule creation and suspicious sign-in |
AuditM1047
Enterprise email solutions have monitoring mechanisms that may include the ability to audit auto-forwarding rules on a regular basis. In an Exchange environment, Administrators can use Get-InboxRule to discover and remove potentially malicious auto-forwarding rules.
Use of encryption provides an added layer of security to sensitive information sent over email. Encryption using public key cryptography requires the adversary to obtain the private certificate along with an encryption key to decrypt messages.
Use of multi-factor authentication for public-facing webmail servers is a recommended best practice to minimize the usefulness of usernames and passwords to adversaries.
Use secure out-of-band authentication methods to verify the authenticity of critical actions initiated via email, such as password resets, financial transactions, or access requests. For highly sensitive information, utilize out-of-band communication channels instead of relying solely on email to prevent adversaries from collecting data through compromised email accounts.