Local Email Collection (T1114.001) is a sub-technique of Email Collection, in the collection tactic. MITRE lists Windows.
If an attacker is on a user's machine, they do not need the mail server. The mailbox is partly or wholly cached in files on disk.
How attackers use it
MITRE describes targeting user email on local systems, acquiring files such as Outlook storage or cache files. It gives these details about Outlook:
- Outlook stores data locally in offline data files with the extension .ost.
- Outlook 2010 and later supports .ost files up to 50GB, while earlier versions support up to 20GB.
- IMAP accounts in Outlook 2013 and earlier, and POP accounts, use Outlook data files with the extension .pst. IMAP accounts in Outlook 2016 and later use .ost files.
- Both types are typically stored in the user's Documents folder under Outlook Files, or in AppData under Local and Microsoft and Outlook.
Large files, in known places, readable by the user's own account, make this simple to do.
How to detect it
MITRE's strategy is Detect Local Email Collection via Outlook Data File Access and Command Line Tooling. The analytic focuses on processes that try to find, read or move local Outlook data files using file system access, native Windows utilities such as PowerShell and WMI, or remote access tools with file browsing. The behavior chain is directory enumeration, file access, optional compression or staging, and network transfer.
Useful signals:
- A process other than Outlook opening .pst or .ost files.
- Copies of those files to a staging folder, a share or removable media.
- Compression of large mail files, followed by an outbound transfer.
- Enumeration of the Outlook folders by scripts.
File access auditing on those directories, endpoint file events and process logs together give you this view.
How to reduce the risk
MITRE lists two mitigations:
- Encrypt sensitive information. Public key encryption means an adversary needs the private certificate and a key to decrypt messages, so stolen mail files are less useful.
- Out-of-band communications. Set up out-of-band alerts to notify security teams of unusual local email activity, such as mass forwarding or large attachments being sent.
Also consider whether staff need large local caches, and use disk encryption on laptops.
Quick check
What file types does Outlook use for local mail storage?
.ost offline data files, and .pst Outlook data files for POP accounts and older IMAP setups.
What is the typical chain MITRE describes?
Directory enumeration, file access, optional compression or staging, then network transfer.
Sources
- MITRE ATT&CK, Email Collection: Local Email Collection (T1114.001)
