Email Collection

What is Email Collection?

Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients. Common methods include accessing local email files such as Outlook PST files, using Exchange Web Services or the Graph API to download emails programmatically, forwarding rules that redirect emails to attacker-controlled accounts, and accessing webmail interfaces using compromised credentials. Business email compromise (BEC) operations extensively use email collection to understand payment processes, executive communication styles, and identify impersonation opportunities. State-sponsored attackers target email for intelligence gathering, focusing on communications related to sensitive negotiations, policy positions, and confidential business strategies.

“Email Collection is documented as technique T1114 in the MITRE ATT&CK knowledge base under the Collection tactic. Detection requires visibility into SIEM, XDR telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Email Collection activity. These methods apply across SIEM, XDR environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor Exchange and Office 365 audit logs for unusual email export operations, mailbox access by non-owners, and use of Exchange Web Services for bulk email retrieval from accounts with no administrative function.

2. 2

   Alert on email forwarding rule creation, particularly rules that forward messages to external email addresses or that use broad criteria to forward all messages or messages matching business-sensitive keywords.

3. 3

   Detect programmatic access to email APIs using service accounts or OAuth applications requesting broader mail permissions than typical business applications require, especially new application registrations.

4. 4

   Monitor for access to Outlook data files (PST, OST) by processes other than Outlook itself, as attackers may attempt to copy these files for offline analysis containing years of email communication history.

5. 5

   Alert on unusually large email downloads through webmail interfaces or sync clients that significantly exceed the user normal email activity baseline, which may indicate bulk collection prior to exfiltration.

Example Alerts

These realistic alert examples show what Email Collection looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Email Collection?

SOC analysts detect Email Collection (T1114) by monitoring SIEM, XDR telemetry for behavioral anomalies and specific indicators. Key detection methods include monitor exchange and office 365 audit logs for unusual email export operations, mailbox access by non-owners, and use of exchange web services for bul. SOCSimulator provides hands-on practice detecting this technique with realistic alerts.

What security tools are used to detect Email Collection?

Email Collection can be detected using SIEM, XDR platforms. SIEM tools are particularly effective for this technique because they provide visibility into the collection phase of the attack chain. SOCSimulator simulates all three tool types for hands-on training.

How common is Email Collection in real-world attacks?

Email Collection is a well-documented MITRE ATT&CK technique in the Collection tactic. It appears in threat intelligence reports from multiple security vendors and has been observed in campaigns by various threat actor groups. SOCSimulator includes realistic Email Collection scenarios based on documented attack patterns, helping analysts build detection intuition.

Can I practice detecting Email Collection for free?

Yes. SOCSimulator offers free forever access to training scenarios, including Collection techniques like Email Collection. You can investigate realistic alerts in guided Operations rooms, build detection skills with SIEM, XDR, and Firewall interfaces, and test yourself under pressure in Shift Mode. No credit card required.