Scattered SpiderG1015 ↗
Searched the victim’s Microsoft Exchange for emails about the intrusion and incident response.1
tfMITRE ATT&CK technique
Email Collection T1114
- Tactic
- Collection
- Platforms
- Windows, macOS, Linux, Office Suite
- Version
- 2.6
- Created
- 31 May 2017
- Last modified
- 24 October 2025
- Contributors
- Swetha Prabakaran, Microsoft Threat Intelligence Center (MSTIC); Menachem Goldstein
Sub-techniques 336 rules across the family · 6 mapped directly to T1114 · 3 of 3 carry rules
Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses.[1][2] Adversaries can collect or forward email from mail servers or clients.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
4
Threat groups70th pct
Threat groups70th percentile · 64% of ATT&CK techniques have fewer threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.2
Tools & malware51st pct
Tools & malware51st percentile · 44% of ATT&CK techniques have fewer tools implementing them.6
Detection rules67th pct
Detection rules67th percentile · 64% of ATT&CK techniques have fewer detection rules written.