MITRE ATT&CKsub-technique

T1114.001 Local Email Collection

Published 2020-02-19 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Collection
Platforms
Windows
Version
1.1
Created
2020-02-19

Description

Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files. Outlook stores data locally in offline data files with an extension of .ost. Outlook 2010 and later supports .ost file sizes up to 50GB, while earlier versions of Outlook support up to 20GB. IMAP accounts in Outlook 2013 (and earlier) and POP accounts use Outlook Data Files (.pst) as opposed to .ost, whereas IMAP accounts in Outlook 2016 (and later) use .ost files. Both types of Outlook data files are typically stored in `C:\Users\\Documents\Outlook Files` or `C:\Users\\AppData\Local\Microsoft\Outlook`.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1114 Email Collection technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1060 Out-of-Band Communications Channel mitigation
  • M1041 Encrypt Sensitive Information mitigation

Referenced by MITRE ATT&CK · uses (21)

  • G1059 NIMBUS MANTICORE group
  • G1054 MirrorFace group
  • G1041 Sea Turtle group
  • G1039 RedCurl group
  • G1035 Winter Vivern group
  • S1142 LunarMail software (malware)
  • C0002 Night Dragon campaign
  • S0650 QakBot software (malware)
  • S0594 Out1 software (tool)
  • S0526 KGH_SPY software (malware)
  • G0114 Chimera group
  • G0090 WIRTE group
  • S0367 Emotet software (malware)
  • S0363 Empire software (tool)
  • S0192 Pupy software (tool)
  • S0226 Smoke Loader software (malware)
  • G0059 Magic Hound group
  • G0006 APT1 group
  • S0030 Carbanak software (malware)
  • S0050 CosmicDuke software (malware)
  • S0115 Crimson software (malware)

Referenced by Compliance · mitigates (10)

  • CIS-4.11 Enforce Remote Wipe Capability on Portable End-User Devices CIS Safeguard v8.1
  • NIST-AC-16 Security and Privacy Attributes NIST 800-53 control
  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-19 Access Control for Mobile Devices NIST 800-53 control
  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-SC-37 Out-of-band Channels NIST 800-53 control
  • NIST-SI-12 Information Management and Retention NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References