TA0009 · COLLECTION
Local Email Collection
Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files.
Detect it with
Monitor processes and command-line arguments for actions that could be taken to gather local email files. Monitor for unusual processes accessing local email files.
Why it matters on shift
Local Email Collection is one of the concrete ways adversaries achieve collection. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After collection, the next tactic is usually Command and Control. Search your telemetry for the transition before closing the ticket.
Kill-chain context