T1114: Email Collection
Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses.[1][2] Adversaries can collect or forward email from mail servers or clients.
Analyst context for executives and security teams
Email is often where sensitive business context lives: negotiations, personal information, trade secrets, credentials-adjacent content, and incident response discussions. T1114 matters because an adversary who can collect or forward email may gain intelligence that helps them understand the organization, monitor response activity, or continue collecting information even after initial access is addressed.
Executive priority
Treat email collection as a high-value data exposure and incident-management risk, not only a mailbox issue. Leaders should ask whether critical mail systems and local mail stores are covered by MFA, auditing, encryption, and out-of-band incident communications. The business decision point is whether the organization can prove who accessed mail, what forwarding or collection paths exist, and whether response teams can communicate safely if normal email is suspected compromised.
Technical view
ATT&CK lists this technique under Collection across Windows, macOS, Linux, and Office Suite environments, with sub-techniques for local email collection, remote email collection, and email forwarding rules. SOC and IR teams should validate coverage for local mail artifacts, mail server or cloud mailbox access, and creation or modification of forwarding rules. Relationship context identifies DET0476, Email Collection via Local Email Access and Auto-Forwarding Behavior, as a detection strategy, and mitigations including MFA, encryption of sensitive information, auditing, and out-of-band communications.
Likely telemetry
- Mailbox access and authentication logs for Office Suite or mail server environments
- Email forwarding rule creation, modification, and deletion events
- Mailbox audit logs showing message access, search, export, or unusual access patterns where available
- Endpoint file telemetry for local email stores or caches on Windows, macOS, and Linux where applicable
- Administrative audit logs for mail configuration changes
Detection direction
- Confirm that mailbox auditing and administrative auditing are enabled and retained long enough to support investigations.
- Tune detections for unusual forwarding-rule behavior, especially rules that silently redirect, copy, or hide messages.
- Correlate mailbox access with identity signals such as MFA status, new locations, new devices, or abnormal access timing where those logs are available.
- Include local email collection paths in endpoint investigations, not only cloud mailbox access.
- Account for false positives from legitimate delegates, compliance exports, mailbox migrations, journaling, and user-created forwarding rules.
Mitigation priorities
- Prioritize MFA for critical email and administrative access, consistent with M1032.
- Enable and regularly review audit logging for mailbox access, forwarding changes, and mail administration, consistent with M1047.
- Protect sensitive email content and local mail data with appropriate encryption controls, consistent with M1041.
- Establish secure out-of-band communications for incident response so adversaries monitoring email cannot observe response actions, consistent with M1060.
- Review and govern forwarding rules, delegated access, and mail access paths as part of identity and access management control assurance.
Analyst notes and limits
The relationship set shows use of this technique by multiple groups and software entries, but this take does not infer current activity or exposure for any specific organization. The most decision-useful validation is whether the organization can detect both remote mailbox collection and persistent forwarding behavior, while also preserving IR communications outside normal email.
The official ATT&CK object does not provide a detection section. Detection and telemetry guidance here is derived from the technique description, platforms, sub-technique relationships, DET0476 relationship, and listed mitigations. Local mail architecture, logging configuration, retention, and identity controls are required to determine actual coverage.
Email Collection
Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses.[1][2] Adversaries can collect or forward email from mail servers or clients.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1114.002 | Remote Email Collection Sub-technique | Remote Email Collection subtechnique of this object. |
| Enterprise | T1114.003 | Email Forwarding Rule Sub-technique | Email Forwarding Rule subtechnique of this object. |
| Enterprise | T1114.001 | Local Email Collection Sub-technique | Local Email Collection subtechnique of this object. |
Groups, software, and campaigns
G1003: Ember Bear
Ember Bear is a Russian state-sponsored cyber espionage group that has been active since at least 2020, linked to Russia's General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155).[1] Ember Bear has primarily focused operations against Ukrainian government and telecommunication entities, but has also operated against critical infrastructure entities in Europe and the Americas.[2] Ember Bear conducted the WhisperGate destructive wiper attacks against Ukraine in early 2022.[3][4][1] There is some confusion as to whether Ember Bear overlaps with another Russian-linked entity referred to as Saint Bear. At present available evidence strongly suggests these are distinct activities with different behavioral profiles.[2][5]
G0122: Silent Librarian
Silent Librarian is a group that has targeted research and proprietary data at universities, government agencies, and private sector companies worldwide since at least 2013. Members of Silent Librarian are known to have been affiliated with the Iran-based Mabna Institute which has conducted cyber intrusions at the behest of the government of Iran, specifically the Islamic Revolutionary Guard Corps (IRGC).[1][2][3]
G0059: Magic Hound
Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.[1][2][3][4][5]
G1015: Scattered Spider
Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. [1] [2] The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. [2] Scattered Spider relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. [3] [4] [5] Scattered Spider had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. [6]
S0367: Emotet
S1201: TRANSLATEXT
TRANSLATEXT is malware that is believed to be used by Kimsuky.[1] TRANSLATEXT masqueraded as a Google Translate extension for Google Chrome, but is actually a collection of four malicious Javascript files that perform defense evasion, information collection and exfiltration.[1]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 2.6 | Current bundle | 02eca8059766… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
TrustedSec OOB Communications
Tyler Hudak. (2022, December 29). To OOB, or Not to OOB?: Why Out-of-Band Communications are Essential for Incident Response. Retrieved August 30, 2024.
Open source URL -
[2]
CISA AA20-352A 2021
CISA. (2021, April 15). Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations. Retrieved August 30, 2024.
Open source URL -
[3]
Microsoft Tim McMichael Exchange Mail Forwarding 2
McMichael, T.. (2015, June 8). Exchange and Office 365 Mail Forwarding. Retrieved October 8, 2019.
Open source URL -
[4]
mitre-attack T1114Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.