MITRE ATT&CKsub-technique
T1114.002 Remote Email Collection
- Domain
- enterprise
- Tactics
- Collection
- Platforms
- Office Suite, Windows
- Version
- 1.4
- Created
- 2020-02-19
Description
Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as MailSniper can be used to automate searches for specific keywords.
Related
Subtechnique of · MITRE ATT&CK (1)
- T1114 Email Collection technique
Tactic · MITRE ATT&CK (1)
- TA0009 Collection tactic
Referenced by MITRE ATT&CK · mitigates (3)
Referenced by MITRE ATT&CK · uses (20)
- C0063 2025 Poland Wiper Attacks campaign
- G1055 VOID MANTICORE group
- C0038 HomeLand Justice campaign
- G1033 Star Blizzard group
- C0024 SolarWinds Compromise campaign
- G0125 HAFNIUM group
- G0114 Chimera group
- S0476 Valak software (malware)
- S0413 MailSniper software (tool)
- G0094 Kimsuky group
- S0395 LightNeuron software (malware)
- G0085 FIN4 group
- G0077 Leafminer group
- G0059 Magic Hound group
- G0004 Ke3chang group
- G0006 APT1 group
- G0007 APT28 group
- G0016 APT29 group
- G0035 Dragonfly group
- S0053 SeaDuke software (malware)
Referenced by CAPEC · att&ck technique (1)
- CAPEC-555 Remote Services with Stolen Credentials attack pattern
Referenced by Compliance · mitigates (15)
- CIS-6.3 Require MFA for Externally-Exposed Applications CIS Safeguard v8.1
- NIST-AC-16 Security and Privacy Attributes NIST 800-53 control
- NIST-AC-17 Remote Access NIST 800-53 control
- NIST-AC-19 Access Control for Mobile Devices NIST 800-53 control
- NIST-AC-20 Use of External Systems NIST 800-53 control
- NIST-AC-3 Access Enforcement NIST 800-53 control
- NIST-AC-4 Information Flow Enforcement NIST 800-53 control
- NIST-CM-2 Baseline Configuration NIST 800-53 control
- NIST-CM-6 Configuration Settings NIST 800-53 control
- NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
- NIST-IA-5 Authenticator Management NIST 800-53 control
- NIST-SC-37 Out-of-band Channels NIST 800-53 control
- NIST-SI-12 Information Management and Retention NIST 800-53 control
- NIST-SI-4 System Monitoring NIST 800-53 control
- NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control
References
- https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF Cybersecurity Advisory GRU Brute Force Campaign July 2021