T1114.002 Remote Email Collection

T1114.002 Remote Email Collection

Sub-technique of: T1114

High-Level Description

Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as MailSniper can be used to automate searches for specific keywords.

Kill Chain Phase

• Collection (TA0009)

Platforms: Windows, Office Suite

What to Check

• Identify if Remote Email Collection technique is applicable to target environment
• Check Windows systems for indicators of Remote Email Collection
• Check Office Suite systems for indicators of Remote Email Collection
• Verify mitigations are bypassed or absent (3 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to Remote Email Collection by examining the target platforms (Windows, Office Suite).

2. Assess Existing Defenses: Review whether mitigations for T1114.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1060 Out-of-Band Communications Channel

Use secure out-of-band authentication methods to verify the authenticity of critical actions initiated via email, such as password resets, financial transactions, or access requests.