T1114: Email Collection
AI Answer
Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect (Source: MITRE ATT&CK T1114)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1114 |
| Name | Email Collection |
| Tactic | Collection (collection) |
| Platforms | Windows, macOS, Linux, Office Suite |
| Sub-technique | No |
Why it matters
In the OpenTrojan knowledge graph, Email Collection (T1114) is one of the highest-connectivity ATT&CK techniques: 6 MITRE STIX relationships reference this technique; 4 threat groups observed using it; 2 software families associated; 2 OpenTrojan content pages reference it. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1114). Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients.
Detection
Not available — MITRE ATT&CK does not currently publish a structured detection strategy for this technique in the ingested dataset.
Mitigation
Not available — no MITRE course-of-action was found for this technique in the ingested dataset.
Related Software
- Emotet
- TRANSLATEXT
Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).
Related Threat Groups
- Scattered Spider
- Silent Librarian
- Ember Bear
- Magic Hound
Group associations are from MITRE ATT&CK STIX relationships.
Related Content
References
- https://attack.mitre.org/techniques/T1114
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-352a
- https://blogs.technet.microsoft.com/timmcmic/2015/06/08/exchange-and-office-365-mail-forwarding-2
- https://trustedsec.com/blog/to-oob-or-not-to-oob-why-out-of-band-communications-are-essential-for-incident-response
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1114 Email Collection. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1114 Email Collection?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.