VOID MANTICOREG1055 ↗
Has gathered victim email-content from victim servers.1
tfMITRE ATT&CK sub-technique
Remote Email Collection T1114.002
sub-technique of T1114 Email Collection
- Tactic
- Collection
- Platforms
- Office Suite, Windows
- Version
- 1.3
- Created
- 19 February 2020
- Last modified
- 12 May 2026
- Contributor
- Arun Seelagan, CISA
Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as MailSniper can be used to automate searches for specific keywords.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
13
Threat groupsTop 14%
Threat groups86th percentile · 86% of ATT&CK techniques have this many threat groups attributed or fewer.3
CampaignsTop 12%
Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.4
Tools & malware62nd pct
Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.11
Detection rulesTop 23%
Detection rules77th percentile · 77% of ATT&CK techniques have this many detection rules written or fewer.Remote Email Collection MITRE reference T1114.002
Top 14%of all ATT&CK techniques for number of groups
13 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Star BlizzardG1033 ↗
Has remotely accessed victims' email accounts to steal messages and attachments.1
HAFNIUMG0125 ↗
ChimeraG0114 ↗
Has harvested data from remote mailboxes including through execution of <code>\\<hostname>\c$\Users\<username>\AppData\Local\Microsoft\Outlook*.ost</code>.1
KimsukyG0094 ↗
Has used tools such as the MailFetch mail crawler to collect victim emails (excluding spam) from online services via IMAP.1
FIN4G0085 ↗
Has accessed and hijacked online email communications using stolen credentials.12
All 13 groups for this technique · 6 newest in this preview
3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
2025 Poland Wiper AttacksC0063 ↗
During the 2025 Poland Wiper Attacks, the adversaries leveraged stolen credentials within cloud services to gather data and email messages from Exchange services related to OT topics and technical work carried out within organizations.1
HomeLand JusticeC0038 ↗
During HomeLand Justice, threat actors made multiple HTTP POST requests to the Exchange servers of the victim organization to transfer data.1
SolarWinds CompromiseC0024 ↗
During the SolarWinds Compromise, APT29 collected emails from specific individuals, such as executives and IT staff, using New-MailboxExportRequest followed by Get-MailboxExportRequest.12
All 3 campaigns for this technique
4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
ValakS0476 ↗
Can collect sensitive mailing information from Exchange servers, including credentials and the domain certificate of an enterprise.1
MailSniperS0413 ↗
Can be used for searching through email in Exchange and Office 365 environments.1
LightNeuronS0395 ↗
Collects Exchange emails matching rules specified in its configuration.1
SeaDukeS0053 ↗
Some SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials.1
All 4 software entries for this technique
Offense vs defense T1114.002
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 3Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 11
first rule: 2020 Q2 · 3 of 3 campaigns plottedRemote Email Collection detection strategy DET0048
MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Remote Email Collection via Abnormal Login and Programmatic Access
2 platforms
AN0131 · Windows
Detects adversaries accessing remote mail systems (e.g., Exchange Online, O365) using stolen credentials or OAuth tokens, followed by scripted access to mailbox contents via PowerShell, AADInternals, or unattended API queries. Detection focuses on abnormal logon sessions, user agents, IP locations, and scripted or tool-based email data access.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | m365:purview | MailItemsAccessed & Exchange Audit |
| Command ExecutionDC0064 | WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 |
| Logon Session CreationDC0067 | azure:signinlogs | Abnormal sign-in from scripting tools (PowerShell, AADInternals) |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UserAgentPattern | Filters user agents like 'PowerShell', 'AADInternals', 'python-requests' which can vary depending on script/tool. |
| TimeWindow | Defines the temporal correlation window between login, command execution, and outbound email access. |
| KnownIPLocations | Defines baseline geo/IP address ranges to suppress known corporate access. |
| PrivilegedUserList | Defines the accounts considered privileged (admin, execs) and worthy of tighter thresholds. |
AN0132 · Office Suite
Monitors programmatic access to user mailboxes in cloud-based email systems (e.g., O365, Exchange Online) using APIs or tokens. Focuses on OAuth misuse, suspicious MailItemsAccessed patterns, scripted keyword searches, and connections from untrusted agents or locations.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | m365:purview | MailItemsAccessed, Search-Mailbox events |
| Command ExecutionDC0064 | m365:unified | Search-Mailbox, Get-MessageTrace, eDiscovery requests |
| Logon Session CreationDC0067 | azure:signinlogs | Suspicious login to cloud mailbox system |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MailAccessVolumeThreshold | Number of emails accessed within time window to flag anomaly. |
| OAuthClientIDAllowList | Allows tuning based on known app registrations. |
| KeywordSearchFrequency | Flag high volumes of message searches using suspicious patterns. |
| LoginGeolocationVariance | Trigger when IP geolocation varies significantly from user's historical profile. |
Use of encryption provides an added layer of security to sensitive information sent over email. Encryption using public key cryptography requires the adversary to obtain the private certificate along with an encryption key to decrypt messages.
Use of multi-factor authentication for public-facing webmail servers is a recommended best practice to minimize the usefulness of usernames and passwords to adversaries.
Use secure out-of-band authentication methods to verify the authenticity of critical actions initiated via email, such as password resets, financial transactions, or access requests. For highly sensitive information, utilize out-of-band communication channels instead of relying solely on email. This reduces the risk of sensitive data being collected through compromised email accounts. Set up out-of-band alerts to notify security teams of unusual email activities, such as mass forwarding or large attachments being sent, which could indicate email collection attempts. Create plans for leveraging a secure out-of-band communications channel, rather than an existing in-network email server, in case of a security incident.
Tests1ExecutorsPowerShell 1Need elevation0 of 1Have prerequisites1Have cleanup1Platformsoffice-365
Tests from Atomic Red Team (MIT licence) · technique definition