MITRE ATT&CKtechnique

T1114 Email Collection

Published 2017-05-31 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Collection
Platforms
Windows, macOS, Linux, Office Suite
Version
2.6
Created
2017-05-31

Description

Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (4)

  • M1060 Out-of-Band Communications Channel mitigation
  • M1041 Encrypt Sensitive Information mitigation
  • M1047 Audit mitigation
  • M1032 Multi-factor Authentication mitigation

Referenced by MITRE ATT&CK · subtechnique of (3)

  • T1114.001 Local Email Collection sub-technique
  • T1114.002 Remote Email Collection sub-technique
  • T1114.003 Email Forwarding Rule sub-technique

Referenced by MITRE ATT&CK · uses (6)

  • S1201 TRANSLATEXT software (malware)
  • G1015 Scattered Spider group
  • G1003 Ember Bear group
  • G0122 Silent Librarian group
  • S0367 Emotet software (malware)
  • G0059 Magic Hound group

Referenced by Compliance · mitigates (16)

  • CIS-6.3 Require MFA for Externally-Exposed Applications CIS Safeguard v8.1
  • NIST-AC-16 Security and Privacy Attributes NIST 800-53 control
  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-19 Access Control for Mobile Devices NIST 800-53 control
  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-SC-37 Out-of-band Channels NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-12 Information Management and Retention NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References