Email Collection
- ID
- T1114
- Tactics
- TA0009 Collection
- Platforms
- Windows, macOS, Linux, Office Suite
- Data sources
- Network Share Access, Command Execution, Application Log Content, Network Connection Creation, File Access, Process Creation, Logon Session Creation
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses.[2][3] Adversaries can collect or forward email from mail servers or clients.
Sub-techniques (3)
Detection
- DET0476 Email Collection via Local Email Access and Auto-Forwarding Behavior
Data components: Network Share Access, Command Execution, Application Log Content, Network Connection Creation, File Access, Process Creation, Logon Session Creation
Mitigations (4)
- M1032 Multi-factor Authentication
Use of multi-factor authentication for public-facing webmail servers is a recommended best practice to minimize the usefulness of usernames and passwords to adversaries.
- M1041 Encrypt Sensitive Information
Use of encryption provides an added layer of security to sensitive information sent over email. Encryption using public key cryptography requires the adversary to obtain the private certificate along with an encryption key to decrypt messages.
- M1047 Audit
Enterprise email solutions have monitoring mechanisms that may include the ability to audit auto-forwarding rules on a regular basis.
In an Exchange environment, Administrators can use Get-InboxRule to discover and remove potentially malicious auto-forwarding rules.[1]
- M1060 Out-of-Band Communications Channel
Use secure out-of-band authentication methods to verify the authenticity of critical actions initiated via email, such as password resets, financial transactions, or access requests. For highly sensitive information, utilize out-of-band communication channels instead of relying solely on email to prevent adversaries from collecting data through compromised email accounts.[2]