T1114 Email Collection — ATT&CK Technique

Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients.

Detection coverage (6)

• PST Export Alert Using eDiscovery Alert medium
• PST Export Alert Using New-ComplianceSearchAction medium
• Exchange PowerShell Snap-Ins Usage high
• Hacktool Ruler high
• O365 New Forwarding Mailflow Rule Created
• O365 PST export alert

Malware using this technique

• Emotet
• TRANSLATEXT

Threat actors using this technique

• Ember Bear
• Silent Librarian
• APT35
• Scattered Spider

Read the full analysis on IntelFusions