Loading interactive filters…

1200KM / detection

T1114 Email Collection — Detection Rules

Detection workspace for T1114 Email Collection: 4 Sigma sources, 1 Atlas concepts and 1 anomaly models. No live detection validation.

Source-backed rule directory

PST Export Alert Using eDiscovery Alert · test · medium · {"service":"threat_management","product":"m365","definition":"Requires the 'eDiscovery search or exported' alert to be enabled"}
PST Export Alert Using New-ComplianceSearchAction · test · medium · {"service":"threat_management","product":"m365"}
Hacktool Ruler · test · high · {"product":"windows","service":"security"}
Exchange PowerShell Snap-Ins Usage · test · high · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1114 Email Collection

COUNT(message_read_or_export BY actor, 10m) >= threshold OR MATCH(mailbox_export_operation) -> ALERT

Anomaly models

Email content collected — T1114 Email Collection

Comparison unit: mailbox actor and operation stream.

Expected behavior: users read and export bounded message sets.

Deviation: unusual read volume, export operation, or actor-mailbox edge.

ATT&CK analytic guidance

DET0476 Email Collection via Local Email Access and Auto-Forwarding Behavior

AN1309 Analytic 1309

Correlates creation of email forwarding rules or header anomalies (e.g., X-MS-Exchange-Organization-AutoForwarded) with suspicious process execution, file access of .pst/.ost files, and network connections to external SMTP servers.

AN1310 Analytic 1310

Detects file access to mbox/maildir files in conjunction with curl/wget/postfix execution, or anomalous shell scripts harvesting user mail directories.

AN1311 Analytic 1311

Monitors Mail.app database or maildir file access, automation via AppleScript, and abnormal mail rule creation using scripting or UI automation frameworks.

AN1312 Analytic 1312

Correlates unusual auto-forwarding rule creation via Exchange Web Services or Outlook rules engine, presence of X-MS-Exchange-Organization-AutoForwarded headers, and logon session anomalies from abnormal IPs.

Connected ecosystem references

Linked tags

rule_source_available Edge Anomaly Rare-Category Anomaly Volume Anomaly

Simulation, tools and telemetry

T1114 simulation workspace

No reviewed association in this snapshot.

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing anomaly research

Original publication snapshot · Anomaly Detection Atlas

Connected anomaly research

Curated research views reached through an exact source technique, a catalog model, or a reviewed collection reference. These are navigation associations, not claims of detector effectiveness or sensor equivalence.

Data Movement

Telemetry contracts · Maintained query examples · Validation and blind spots

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.