Email Collection

What is Email Collection?

“Email Collection is documented as technique T1114 in MITRE ATT&CK® v19.1 under the Collection tactic. Detection requires visibility into SIEM, XDR telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Email Collection activity. These methods apply across SIEM, XDR environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor Exchange and Office 365 audit logs for unusual email export operations, mailbox access by non-owners, and use of Exchange Web Services for bulk email retrieval from accounts with no administrative function.

2. 2

   Alert on email forwarding rule creation, particularly rules that forward messages to external email addresses or that use broad criteria to forward all messages or messages matching business-sensitive keywords.

3. 3

   Detect programmatic access to email APIs using service accounts or OAuth applications requesting broader mail permissions than typical business applications require, especially new application registrations.

4. 4

   Monitor for access to Outlook data files (PST, OST) by processes other than Outlook itself, as attackers may attempt to copy these files for offline analysis containing years of email communication history.

5. 5

   Alert on unusually large email downloads through webmail interfaces or sync clients that significantly exceed the user normal email activity baseline, which may indicate bulk collection prior to exfiltration.

Example Alerts

These realistic alert examples show what Email Collection looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Email Collection?

Detection centers on SIEM, XDR telemetry for the collection phase of the attack. Monitor Exchange and Office 365 audit logs for unusual email export operations, mailbox access by non-owners, and use of Exchange Web Services for bulk email retrieval from accounts with no administrative function. Alert on email forwarding rule creation, particularly rules that forward messages to external email addresses or that use broad criteria to forward all messages or messages matching business-sensitive keywords.

What does a Email Collection alert look like?

A representative SIEM detection is "Email Forwarding Rule Created to External Account" (high severity): Office 365 audit log recorded creation of a new inbox rule for CFO account ceo@company.com that forwards all messages containing keywords "invoice", "payment", "wire transfer", and "bank" to an external Gmail address. This forwarding rule was created at 11:43 PM using the account after successful MFA bypass. The rule enables ongoing email monitoring and is a common precursor to BEC fraud.

Which tools detect Email Collection, and how can I practice?

Email Collection (T1114) is best surfaced with SIEM, XDR telemetry, which exposes the collection signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.