MITRE ATT&CK / T1114.002
T1114.002
Remote Email Collection
SUB-TECHNIQUE Collection
Description
Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords.
Platforms
Office SuiteWindows
Mitigations
- M1060 — Out-of-Band Communications Channel
- M1041 — Encrypt Sensitive Information
- M1032 — Multi-factor Authentication
Look up any technique
Use our free MITRE ATT&CK lookup tool, or browse the full ATT&CK matrix.
Source: MITRE ATT&CK Enterprise matrix. View on attack.mitre.org →