Detecting and Mitigating Email Collection (T1114)

Email Collection (T1114) is a collection technique in MITRE ATT&CK. MITRE lists Windows, macOS, Linux and Office suite platforms. It has three sub-techniques: local email collection, remote email collection and email forwarding rules. Each has its own post in this series.

Email is a rich target for a plain reason. People put almost everything in it.

How attackers use it

MITRE describes adversaries targeting user email to collect sensitive information. Mail may contain trade secrets or personal information. It may also contain details of ongoing incident response, which can let an adversary adjust techniques to keep persistence or avoid defenses. Adversaries can collect or forward email from mail servers or clients.

The three sub-techniques cover where the collection happens:

• Local: mail files on the user's machine, such as Outlook data files.
• Remote: mailboxes accessed on Exchange, Office 365 or Google Workspace with credentials or tokens.
• Forwarding rules: rules that copy or redirect incoming mail.

How to detect it

MITRE's strategy is Email Collection via Local Email Access and Auto-Forwarding Behavior. Its analytics describe:

• On Windows, forwarding rule creation or header anomalies such as X-MS-Exchange-Organization-AutoForwarded, correlated with suspicious process execution, access to .pst and .ost files and connections to external SMTP servers.
• On Linux, access to mbox or maildir files together with curl, wget or postfix execution, or shell scripts harvesting user mail directories.
• On macOS, Mail.app database or maildir access, automation through AppleScript and unusual rule creation.
• Unusual auto-forwarding rule creation through Exchange Web Services or the Outlook rules engine, with logon sessions from abnormal addresses.

Practical data sources are mailbox audit logs, mail flow and header data, endpoint file access events for mail stores and cloud sign-in logs.

How to reduce the risk

MITRE lists four mitigations:

1. Audit. Review auto-forwarding rules on a regular basis. In Exchange, administrators can use Get-InboxRule to find and remove malicious auto-forwarding rules.
2. Encrypt sensitive information. Public key encryption means an adversary needs the private certificate and key to read messages.
3. Multi-factor authentication for public-facing webmail servers, to reduce the value of stolen passwords.
4. Out-of-band communications. Verify critical actions requested by email, such as password resets and payments, through a different channel, and keep a plan for secure communication during an incident that does not depend on the compromised mail system.

Check your own environment

• Do you audit forwarding rules, inbox and transport, on a schedule?
• Is external auto-forwarding disabled or limited?
• Is MFA required for every webmail and mailbox access path?
• Do you log mailbox access in your cloud suite?

# Exchange Online or Exchange (PowerShell): list inbox rules for one mailbox, including hidden ones
Get-InboxRule -Mailbox user@example.com -IncludeHidden | Select-Object Name, Enabled, ForwardTo, RedirectTo, ForwardAsAttachmentTo

Where to start if you have little time

Email collection has three variants, and the controls overlap. If you are short on time, work in this order.

1. Turn on and retain mailbox audit logging. Without it, you cannot tell what was read.
2. Block automatic forwarding to external addresses, and review existing rules for any that already forward out.
3. Require MFA for every way into mail, including webmail and mobile access.
4. Write a short runbook step for compromised accounts that says: check forwarding rules, check delegates and app consents, then reset credentials.
5. Agree on an out-of-band channel for incident communication that does not depend on the mail system.

Each of these maps to one of the mitigations MITRE lists, and together they cover local, remote and rule-based collection in practical terms.

Quick check

Sources

• MITRE ATT&CK, Email Collection (T1114)