Remote Email Collection (T1114.002) is a sub-technique of Email Collection. It sits in the collection tactic, and MITRE lists Office suite and Windows platforms.
No malware has to touch the user's laptop. If an attacker holds a valid password or token, they can read the mailbox from anywhere through the mail service itself.
How attackers use it
MITRE describes adversaries targeting an Exchange server, Office 365 or Google Workspace to collect sensitive information. They may use a user's credentials and interact directly with the Exchange server from inside a network. They may also reach externally facing Exchange services, Office 365 or Google Workspace with credentials or access tokens. MITRE notes that tools such as MailSniper can automate searches for specific keywords.
Two points follow for defenders:
- Access tokens count as much as passwords. A token stolen from a browser or an app can be used without any login prompt.
- Keyword searches across a mailbox are fast, so the interesting data, such as password resets, contracts and credentials, is found quickly.
How to detect it
MITRE's strategy is Detect Remote Email Collection via Abnormal Login and Programmatic Access. It has two analytics:
- Access to remote mail systems such as Exchange Online and O365 with stolen credentials or OAuth tokens, followed by scripted access to mailbox contents through PowerShell, AADInternals or unattended API queries. Focus on abnormal logon sessions, user agents, locations and tool-based data access.
- Programmatic access to user mailboxes in cloud email through APIs or tokens, with attention to OAuth misuse, suspicious MailItemsAccessed patterns, scripted keyword searches and connections from untrusted agents or locations.
Data to collect and review:
- Cloud sign-in logs with source address, location, user agent and token details.
- Mailbox audit logs, including the MailItemsAccessed event in Microsoft 365 where it is licensed and enabled.
- OAuth application consent and grant events.
- Search activity and unusually large reads of mail in a short time.
A good baseline question: which clients and applications normally read this user's mail? Anything else, especially a scripting user agent, deserves a look.
How to reduce the risk
MITRE lists three mitigations:
- Encrypt sensitive information with public key encryption, so reading a mailbox is not enough without the private certificate.
- Multi-factor authentication for public-facing webmail servers to reduce the value of stolen passwords.
- Out-of-band communications. Use secure out-of-band authentication to verify critical actions initiated by email, such as password resets, payments and access requests. Set up out-of-band alerts for unusual activity such as mass forwarding or large attachments. Plan a secure channel that does not rely on the in-network mail server for use during an incident.
Check your own environment
- Is mailbox auditing on for every mailbox, and are logs kept long enough to investigate?
- Is MFA required for every webmail and API sign-in path, including older protocols?
- Do you review OAuth app consents and remove apps nobody can explain?
- Do you alert on scripted or programmatic access to many mailboxes?
- Do you have a communications channel ready that does not depend on the mail system?
Quick check
Why do tokens matter as much as passwords for this technique?
MITRE notes adversaries may reach mail with credentials or access tokens. A stolen token can be used without any login or MFA prompt.
What does MITRE recommend for incident communications?
Prepare a secure out-of-band channel that does not use the in-network mail server, in case that server is compromised.
Sources
- MITRE ATT&CK, Email Collection: Remote Email Collection (T1114.002)
