t1114

T1114, commonly described as Email Collection, is a technique in the MITRE ATT&CK framework. It involves gathering email messages and attachments from compromised systems, often with the goal of exfiltrating sensitive information found in inboxes, sent items, or attachments. Adversaries may target local email clients or mail stores and may use standard email protocols or legitimate software to minimize suspicion.

Operationally, attackers can access email data stored by clients such as Microsoft Outlook or Mozilla Thunderbird, or they may leverage server-side APIs to enumerate mailboxes. Methods include reading and copying messages, exporting mailboxes (for example, PST or OST files), forwarding emails, or configuring automated export routes to external destinations. They may utilize legitimate protocols like IMAP, POP3, or MAPI, sometimes employing stolen credentials or compromised accounts to maintain access.

Impact and context: Email collection can facilitate espionage, fraud, or larger data exfiltration campaigns by harvesting confidential communications, attachments, and other sensitive information. It is often one stage in a multi-step intrusion, enabling attackers to map targets, prioritize further data access, or establish channels for ongoing data leakage.

Mitigation and defense: enforce strict access controls and least privilege for email data, monitor for unusual mailbox exports or forwarding rules, and use data loss prevention controls. Deploy endpoint detection and response tools with behavioral analytics to flag anomalous mailbox access, automated export, or forwarding activity. Strengthen authentication for email accounts (multi-factor authentication), segment networks, and audit mailbox access regularly.

Detection: look for large or unexpected mailbox exports, new or altered forwarding rules, scripts or tools accessing email data, and unusual directory or file activity around mailbox stores. Correlate with account login events and network activity to mail servers.