T1114 Email Collection

Technique

T1114

Tactics

Collection

Research, 90 days

0

KEV CVEs mapped

3

SigmaHQ rules

4

Elastic, Splunk

15

thrunt rules

0

Active families

AgentTesla

Upstream

https://attack.mitre.org/techniques/T1114

MITRE description

Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses.(Citation: TrustedSec OOB Communications)(Citation: CISA AA20-352A 2021) Adversaries can collect or forward email from mail servers or clients.

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

• CVE-2024-42009
• CVE-2024-27443
• CVE-2020-0688

Detection coverage

SigmaHQ community rules

• PST Export Alert Using New-ComplianceSearchAction (core)
• PST Export Alert Using eDiscovery Alert (core)
• Hacktool Ruler (core)
• Exchange PowerShell Snap-Ins Usage (core)

Elastic and Splunk rules

• Microsoft Graph Email Access by Unusual User and Client (elastic)
• Google Workspace Gmail Routing or Forwarding Rule Created or Modified (elastic)
• M365 Exchange Mailbox Items Accessed Excessively (elastic)
• M365 Exchange Mailbox Accessed by Unusual Client (elastic)
• M365 Exchange Inbox Forwarding Rule Created (elastic)
• M365 Exchange Mail Flow Transport Rule Created (elastic)
• Suspicious Inter-Process Communication via Outlook (elastic)
• Exporting Exchange Mailbox via PowerShell (elastic)
• Exchange Mailbox Export via PowerShell (elastic)
• PowerShell Mailbox Collection Script (elastic)
• New ActiveSyncAllowedDeviceID Added via PowerShell (elastic)
• M365 Purview DLP Signal (elastic)
• Accessing Outlook Data Files (elastic)
• O365 New Forwarding Mailflow Rule Created (splunk)
• O365 PST export alert (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.