{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1114","id":"T1114","name":"Email Collection","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1114","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"611cdf398a9a74bef50a7c5ad25c62c3b1dda8c702021c201f3499a1dc327c1b","description":"Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses.(Citation: TrustedSec OOB Communications)(Citation: CISA AA20-352A 2021) Adversaries can collect or forward email from mail servers or clients. ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1114","external_id":"T1114"},{"source_name":"CISA AA20-352A 2021","description":"CISA. (2021, April 15). Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations. Retrieved August 30, 2024.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-352a"},{"source_name":"Microsoft Tim McMichael Exchange Mail Forwarding 2","description":"McMichael, T.. (2015, June 8). Exchange and Office 365 Mail Forwarding. Retrieved October 8, 2019.","url":"https://blogs.technet.microsoft.com/timmcmic/2015/06/08/exchange-and-office-365-mail-forwarding-2/"},{"source_name":"TrustedSec OOB Communications","description":"Tyler Hudak. (2022, December 29). To OOB, or Not to OOB?: Why Out-of-Band Communications are Essential for Incident Response. Retrieved August 30, 2024.","url":"https://trustedsec.com/blog/to-oob-or-not-to-oob-why-out-of-band-communications-are-essential-for-incident-response"}],"platforms":["Windows","macOS","Linux","Office Suite"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1114.001","id":"T1114.001","name":"Local Email Collection","page":"techniques/enterprise/T1114.001/"},{"key":"enterprise/T1114.002","id":"T1114.002","name":"Remote Email Collection","page":"techniques/enterprise/T1114.002/"},{"key":"enterprise/T1114.003","id":"T1114.003","name":"Email Forwarding Rule","page":"techniques/enterprise/T1114.003/"}],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0055","name":"File Access","page":"telemetry/DC0055/","kind":"attack_component","category":"Windows and directory audit","description":"Access to file objects with user, process and access-right context.","collection_focus":"Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0067","name":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of a logon session with account and logon-type context.","collection_focus":"Enable Audit Logon and collect successful session creation on the receiving host; join session/logon IDs rather than only account names.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["account","logon_id","logon_type","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0102","name":"Network Share Access","page":"telemetry/DC0102/","kind":"attack_component","category":"Windows and directory audit","description":"Access to a network share or an object through that share.","collection_focus":"Enable Audit File Share / Detailed File Share on the lab file server; correlate share checks with file-system access and requesting host/account.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["share","relative_path","access","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0102","collector":"illustrative-lab-collector","observation":{"share":"\\\\lab-server\\demo","relative_path":"demo.txt","access":"read","source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1114","id":"T1114","name":"Email Collection","domain":"enterprise","platforms":["Windows","macOS","Linux","Office Suite"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1114","technique_page":"techniques/enterprise/T1114/","page":"detections/enterprise/T1114/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[{"id":"18b88d08-d73e-4f21-bc25-4b9892a4fdd0","title":"PST Export Alert Using eDiscovery Alert","status":"test","level":"medium","logsource":{"service":"threat_management","product":"m365","definition":"Requires the 'eDiscovery search or exported' alert to be enabled"},"data_path":"data/detection-rules/18b88d08-d73e-4f21-bc25-4b9892a4fdd0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/m365/threat_management/microsoft365_pst_export_alert.yml","author":"Sorina Ionescu","kind":"sigma"},{"id":"6897cd82-6664-11ed-9022-0242ac120002","title":"PST Export Alert Using New-ComplianceSearchAction","status":"test","level":"medium","logsource":{"service":"threat_management","product":"m365"},"data_path":"data/detection-rules/6897cd82-6664-11ed-9022-0242ac120002.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/m365/threat_management/microsoft365_pst_export_alert_using_new_compliancesearchaction.yml","author":"Nikita Khalimonenkov","kind":"sigma"},{"id":"24549159-ac1b-479c-8175-d42aea947cae","title":"Hacktool Ruler","status":"test","level":"high","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/24549159-ac1b-479c-8175-d42aea947cae.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_alert_ruler.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"25676e10-2121-446e-80a4-71ff8506af47","title":"Exchange PowerShell Snap-Ins Usage","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/25676e10-2121-446e-80a4-71ff8506af47.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_snapins_hafnium.yml","author":"FPT.EagleEye, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1114-1","technique_id":"T1114","title":"T1114 Email Collection","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#collection","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":154,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L154","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"89270631c74c2d49ad8207abf2147da7405934be672bc38d9d3a091353a20a25","validation":"published_concept_not_executable_or_live_validated","logic":"COUNT(message_read_or_export BY actor, 10m) >= threshold OR MATCH(mailbox_export_operation) -> ALERT","log_sources":[{"title":"Mailbox Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#97-mailbox-audit-logs"},{"title":"Application Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#81-application-audit-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1114-1","technique_id":"T1114","title":"Email content collected — T1114 Email Collection","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#mailbox-collection","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":99,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L99","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"e8acc5911957a1dd3d5f97a1f042ea13df08f3a80ba237b2cc6cc58a48b8d2b8","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"mailbox actor and operation stream.","expected_behavior":"users read and export bounded message sets.","deviation":"unusual read volume, export operation, or actor-mailbox edge.","anomaly_types":[{"title":"Volume Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#15-volume-anomaly"},{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Rare-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#84-rare-category-anomaly"}],"log_sources":[{"title":"Mailbox Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#97-mailbox-audit-logs"},{"title":"Application Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#81-application-audit-logs"}],"context_references":[{"title":"Scattered Spider joint advisory — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/fbi-aa23-320a-scattered-spider.pdf"},{"title":"original source","url":"https://www.ic3.gov/CSA/2023/231116.pdf"}]}],"anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Rare-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#84-rare-category-anomaly"},{"title":"Volume Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#15-volume-anomaly"}],"strategies":[{"id":"DET0476","name":"Email Collection via Local Email Access and Auto-Forwarding Behavior","url":"https://attack.mitre.org/detectionstrategies/DET0476","stix_id":"x-mitre-detection-strategy--2470975e-6748-42a5-9a48-74dc7b687fe9","relationship_id":"relationship--48fe7200-61ea-4d8a-89a9-ddcedf2f3313","description":"","analytics":[{"id":"AN1309","name":"Analytic 1309","guidance":"Correlates creation of email forwarding rules or header anomalies (e.g., X-MS-Exchange-Organization-AutoForwarded) with suspicious process execution, file access of .pst/.ost files, and network connections to external SMTP servers.","url":"https://attack.mitre.org/detectionstrategies/DET0476#AN1309","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Defines correlation window across email rule creation and outbound SMTP."},{"field":"UserContext","description":"Filters for admin or service accounts to reduce false positives."},{"field":"SMTPDomainList","description":"Allows tuning based on expected external email domains."}],"log_sources":[{"component_id":"DC0102","component":"Network Share Access","name":"WinEventLog:Security","channel":"EventCode=5145","platforms":["Windows"],"analytic_id":"AN1309","source_url":"https://attack.mitre.org/detectionstrategies/DET0476#AN1309","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0102/"},{"component_id":"DC0064","component":"Command Execution","name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","platforms":["Windows"],"analytic_id":"AN1309","source_url":"https://attack.mitre.org/detectionstrategies/DET0476#AN1309","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0038","component":"Application Log Content","name":"WinEventLog:Application","channel":"Exchange logs or header artifacts","platforms":["Windows"],"analytic_id":"AN1309","source_url":"https://attack.mitre.org/detectionstrategies/DET0476#AN1309","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN1309","source_url":"https://attack.mitre.org/detectionstrategies/DET0476#AN1309","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN1310","name":"Analytic 1310","guidance":"Detects file access to mbox/maildir files in conjunction with curl/wget/postfix execution, or anomalous shell scripts harvesting user mail directories.","url":"https://attack.mitre.org/detectionstrategies/DET0476#AN1310","platforms":["Linux"],"tuning":[{"field":"WatchedMailDirs","description":"Specify user mail directories (/var/mail, ~/Maildir)"},{"field":"ProcessNameList","description":"Tune based on local mail clients or curl usage in environment"},{"field":"TimeWindow","description":"Define how close together access and exfil events must occur"}],"log_sources":[{"component_id":"DC0055","component":"File Access","name":"auditd:SYSCALL","channel":"open","platforms":["Linux"],"analytic_id":"AN1310","source_url":"https://attack.mitre.org/detectionstrategies/DET0476#AN1310","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"linux:syslog","channel":"postfix/smtpd","platforms":["Linux"],"analytic_id":"AN1310","source_url":"https://attack.mitre.org/detectionstrategies/DET0476#AN1310","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0032","component":"Process Creation","name":"linux:osquery","channel":"process_events","platforms":["Linux"],"analytic_id":"AN1310","source_url":"https://attack.mitre.org/detectionstrategies/DET0476#AN1310","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN1311","name":"Analytic 1311","guidance":"Monitors Mail.app database or maildir file access, automation via AppleScript, and abnormal mail rule creation using scripting or UI automation frameworks.","url":"https://attack.mitre.org/detectionstrategies/DET0476#AN1311","platforms":["macOS"],"tuning":[{"field":"ScriptProcessNameList","description":"Script interpreters or automation tools (osascript, Automator, etc.)"},{"field":"WatchedMailFiles","description":"Mail.app SQLite DB or .emlx directory"}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"macos:unifiedlog","channel":"Mail or AppleScript subsystem","platforms":["macOS"],"analytic_id":"AN1311","source_url":"https://attack.mitre.org/detectionstrategies/DET0476#AN1311","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0055","component":"File Access","name":"macos:endpointsecurity","channel":"es_event_open, es_event_exec","platforms":["macOS"],"analytic_id":"AN1311","source_url":"https://attack.mitre.org/detectionstrategies/DET0476#AN1311","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"}]},{"id":"AN1312","name":"Analytic 1312","guidance":"Correlates unusual auto-forwarding rule creation via Exchange Web Services or Outlook rules engine, presence of X-MS-Exchange-Organization-AutoForwarded headers, and logon session anomalies from abnormal IPs.","url":"https://attack.mitre.org/detectionstrategies/DET0476#AN1312","platforms":["Office Suite"],"tuning":[{"field":"UserAgentList","description":"Restrict rules from non-browser agents"},{"field":"ExternalSMTPDomainList","description":"Allow listing for org-sanctioned forwarding domains"},{"field":"TimeWindow","description":"Time delta between rule creation and suspicious sign-in"}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"m365:unified","channel":"Set-Mailbox, New-InboxRule","platforms":["Office Suite"],"analytic_id":"AN1312","source_url":"https://attack.mitre.org/detectionstrategies/DET0476#AN1312","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0038","component":"Application Log Content","name":"m365:exchange","channel":"MessageTrace logs","platforms":["Office Suite"],"analytic_id":"AN1312","source_url":"https://attack.mitre.org/detectionstrategies/DET0476#AN1312","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0067","component":"Logon Session Creation","name":"azure:ad","channel":"SignInEvents","platforms":["Office Suite"],"analytic_id":"AN1312","source_url":"https://attack.mitre.org/detectionstrategies/DET0476#AN1312","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0055","name":"File Access","tag":"File Access","page":"telemetry/DC0055/","kind":"attack_component"},{"id":"DC0067","name":"Logon Session Creation","tag":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0102","name":"Network Share Access","tag":"Network Share Access","page":"telemetry/DC0102/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0367","name":"Emotet","url":"https://attack.mitre.org/software/S0367","kind":"malware","description":"[Emotet](https://attack.mitre.org/software/S0367) has been observed leveraging a module that can scrape email addresses from Outlook.(Citation: CIS Emotet Dec 2018)(Citation: IBM IcedID November 2017)(Citation: Binary Defense Emotes Wi-Fi Spreader)","relationship_id":"relationship--76d0dcb7-046a-40d7-80ec-e0e571359f51","references":[{"source_name":"Binary Defense Emotes Wi-Fi Spreader","description":"Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.","url":"https://www.binarydefense.com/resources/blog/emotet-evolves-with-new-wi-fi-spreader/"},{"source_name":"CIS Emotet Dec 2018","description":"CIS. (2018, December 12). MS-ISAC Security Primer- Emotet. Retrieved March 25, 2019.","url":"https://www.cisecurity.org/white-papers/ms-isac-security-primer-emotet/"},{"source_name":"IBM IcedID November 2017","description":"Kessem, L., et al. (2017, November 13). New Banking Trojan IcedID Discovered by IBM X-Force Research. Retrieved July 14, 2020.","url":"https://securityintelligence.com/new-banking-trojan-icedid-discovered-by-ibm-x-force-research/"}]},{"id":"S1201","name":"TRANSLATEXT","url":"https://attack.mitre.org/software/S1201","kind":"malware","description":"[TRANSLATEXT](https://attack.mitre.org/software/S1201) has exfiltrated collected email addresses to the C2 server.(Citation: Zscaler Kimsuky TRANSLATEXT) ","relationship_id":"relationship--b6c175a3-40a7-4711-886f-c80cb6cd8360","references":[{"source_name":"Zscaler Kimsuky TRANSLATEXT","description":"Park, S. (2024, June 27). Kimsuky deploys TRANSLATEXT to target South Korean academia. Retrieved October 14, 2024.","url":"https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"}]}],"actors":[{"id":"G0059","name":"Magic Hound","url":"https://attack.mitre.org/groups/G0059","kind":"intrusion-set","description":"[Magic Hound](https://attack.mitre.org/groups/G0059) has compromised email credentials in order to steal sensitive data.(Citation: Certfa Charming Kitten January 2021)","relationship_id":"relationship--966e98f6-1460-4305-8993-57ee3f3f5654","references":[{"source_name":"Certfa Charming Kitten January 2021","description":"Certfa Labs. (2021, January 8). Charming Kitten’s Christmas Gift. Retrieved May 3, 2021.","url":"https://blog.certfa.com/posts/charming-kitten-christmas-gift/"}]},{"id":"G0122","name":"Silent Librarian","url":"https://attack.mitre.org/groups/G0122","kind":"intrusion-set","description":"[Silent Librarian](https://attack.mitre.org/groups/G0122) has exfiltrated entire mailboxes from compromised accounts.(Citation: DOJ Iran Indictments March 2018)","relationship_id":"relationship--406fbbc1-408a-4f59-8f0c-0f670eb60879","references":[{"source_name":"DOJ Iran Indictments March 2018","description":"DOJ. (2018, March 23). U.S. v. Rafatnejad et al . Retrieved February 3, 2021.","url":"https://www.justice.gov/usao-sdny/press-release/file/1045781/download"}]},{"id":"G1003","name":"Ember Bear","url":"https://attack.mitre.org/groups/G1003","kind":"intrusion-set","description":"[Ember Bear](https://attack.mitre.org/groups/G1003) attempts to collect mail from accessed systems and servers.(Citation: Cadet Blizzard emerges as novel threat actor)(Citation: CISA GRU29155 2024)","relationship_id":"relationship--168f7ba7-346f-4c70-a08d-f9a13db33c3e","references":[{"source_name":"Cadet Blizzard emerges as novel threat actor","description":"Microsoft Threat Intelligence. (2023, June 14). Cadet Blizzard emerges as a novel and distinct Russian threat actor. Retrieved July 10, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"},{"source_name":"CISA GRU29155 2024","description":"US Cybersecurity & Infrastructure Security Agency et al. (2024, September 5). Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Retrieved September 6, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"id":"G1015","name":"Scattered Spider","url":"https://attack.mitre.org/groups/G1015","kind":"intrusion-set","description":"[Scattered Spider](https://attack.mitre.org/groups/G1015) searched the victim’s Microsoft Exchange for emails about the intrusion and incident response.(Citation: CISA Scattered Spider Advisory November 2023)","relationship_id":"relationship--f9270fc0-7d9f-4380-bf78-1f79fa775455","references":[{"source_name":"CISA Scattered Spider Advisory November 2023","description":"CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]}],"mitigations":[{"id":"M1032","name":"Multi-factor Authentication","url":"https://attack.mitre.org/mitigations/M1032","kind":"course-of-action","description":"Use of multi-factor authentication for public-facing webmail servers is a recommended best practice to minimize the usefulness of usernames and passwords to adversaries.","relationship_id":"relationship--3709ccc2-2370-4dc9-92ac-792867bbdea4","references":[]},{"id":"M1041","name":"Encrypt Sensitive Information","url":"https://attack.mitre.org/mitigations/M1041","kind":"course-of-action","description":"Use of encryption provides an added layer of security to sensitive information sent over email. Encryption using public key cryptography requires the adversary to obtain the private certificate along with an encryption key to decrypt messages.","relationship_id":"relationship--c15c9cbf-7ecc-4e2b-8fe1-636f381bac63","references":[]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Enterprise email solutions have monitoring mechanisms that may include the ability to audit auto-forwarding rules on a regular basis.\n\nIn an Exchange environment, Administrators can use Get-InboxRule to discover and remove potentially malicious auto-forwarding rules.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2) ","relationship_id":"relationship--d60b92c6-2030-4802-8d7d-868ff15f3b0c","references":[{"source_name":"Microsoft Tim McMichael Exchange Mail Forwarding 2","description":"McMichael, T.. (2015, June 8). Exchange and Office 365 Mail Forwarding. Retrieved October 8, 2019.","url":"https://blogs.technet.microsoft.com/timmcmic/2015/06/08/exchange-and-office-365-mail-forwarding-2/"}]},{"id":"M1060","name":"Out-of-Band Communications Channel","url":"https://attack.mitre.org/mitigations/M1060","kind":"course-of-action","description":"Use secure out-of-band authentication methods to verify the authenticity of critical actions initiated via email, such as password resets, financial transactions, or access requests. For highly sensitive information, utilize out-of-band communication channels instead of relying solely on email to prevent adversaries from collecting data through compromised email accounts.(Citation: TrustedSec OOB Communications)","relationship_id":"relationship--bae85c8c-8b02-4a4c-8a38-c46f30c48274","references":[{"source_name":"TrustedSec OOB Communications","description":"Tyler Hudak. (2022, December 29). To OOB, or Not to OOB?: Why Out-of-Band Communications are Essential for Incident Response. Retrieved August 30, 2024.","url":"https://trustedsec.com/blog/to-oob-or-not-to-oob-why-out-of-band-communications-are-essential-for-incident-response"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1114":"/ttp-simulation/techniques/enterprise/T1114/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1114","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0102","collector":"illustrative-lab-collector","observation":{"share":"\\\\lab-server\\demo","relative_path":"demo.txt","access":"read","source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}