TA0009 · COLLECTION
Email Collection
Mailbox exports, forwarding rules, and delegated access used to siphon correspondence.
Detect it with
New inbox rules forwarding externally; New-MailboxExportRequest in Exchange audit logs.
Why it matters on shift
Email Collection is one of the concrete ways adversaries achieve collection. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After collection, the next tactic is usually Command and Control. Search your telemetry for the transition before closing the ticket.
3 sub-techniques
How it shows up in practice
- T1114.001
Local Email Collection
Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files.
- T1114.002
Remote Email Collection
Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network.
- T1114.003
Email Forwarding Rule
Adversaries may setup email forwarding rules to collect sensitive information.
Kill-chain context