CyberStack

MITRE ATT&CK / Techniques / T1114.001

Email Collection: Local Email Collection

ID
T1114.001
Tactics
TA0009 Collection
Sub-technique of
T1114 Email Collection
Platforms
Windows
Data sources
File Access, Process Creation, File Creation, Network Connection Creation
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files.

Outlook stores data locally in offline data files with an extension of .ost. Outlook 2010 and later supports .ost file sizes up to 50GB, while earlier versions of Outlook support up to 20GB.[2] IMAP accounts in Outlook 2013 (and earlier) and POP accounts use Outlook Data Files (.pst) as opposed to .ost, whereas IMAP accounts in Outlook 2016 (and later) use .ost files. Both types of Outlook data files are typically stored in C:\Users\<username>\Documents\Outlook Files or C:\Users\<username>\AppData\Local\Microsoft\Outlook.[3]

Detection

Mitigations (2)

M1041 Encrypt Sensitive Information

Use of encryption provides an added layer of security to sensitive information sent over email. Encryption using public key cryptography requires the adversary to obtain the private certificate along with an encryption key to decrypt messages.

M1060 Out-of-Band Communications Channel

Implement secure out-of-band alerts to notify security teams of unusual local email activities, such as mass forwarding or large attachments being sent, indicating potential data exfiltration attempts.[1]

Groups (9)

Software (11)

References

  1. TrustedSec OOB Communications
  2. Outlook File Sizes
  3. Microsoft Outlook Files