Email Collection
Technique · ATTACK:enterprise:T1114
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1114",
"title": "Email Collection",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1114",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--1608f3e1-598a-42f4-a01a-2e252e81728f",
"external_id": "T1114",
"domain": "enterprise",
"created": "2017-05-31T21:31:25.454Z",
"modified": "2025-10-24T17:48:26.463Z",
"version": "2.6",
"aliases": [
],
"tactics": [
"collection"
],
"source_references": [
{
"source_name": "CISA AA20-352A 2021",
"url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-352a"
},
{
"source_name": "Microsoft Tim McMichael Exchange Mail Forwarding 2",
"url": "https://blogs.technet.microsoft.com/timmcmic/2015/06/08/exchange-and-office-365-mail-forwarding-2/"
},
{
"source_name": "TrustedSec OOB Communications",
"url": "https://trustedsec.com/blog/to-oob-or-not-to-oob-why-out-of-band-communications-are-essential-for-incident-response"
}
]
}Explicit source assertions (13)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1114
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--168f7ba7-346f-4c70-a08d-f9a13db33c3e
Cadet Blizzard emerges as novel threat actor · CISA GRU29155 2024ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1114
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3709ccc2-2370-4dc9-92ac-792867bbdea4
ATTACK:enterprise:T1114.002 → subtechnique-of → ATTACK:enterprise:T1114
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a837390-7974-44e0-9d60-4c9831b8e272
ATTACK:enterprise:G0122 → uses → ATTACK:enterprise:T1114
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--406fbbc1-408a-4f59-8f0c-0f670eb60879
DOJ Iran Indictments March 2018ATTACK:enterprise:T1114.003 → subtechnique-of → ATTACK:enterprise:T1114
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--636ec213-31ce-4e0a-863c-8add1cae68c3
ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1114
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76d0dcb7-046a-40d7-80ec-e0e571359f51
Binary Defense Emotes Wi-Fi Spreader · CIS Emotet Dec 2018 · IBM IcedID November 2017ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1114
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--966e98f6-1460-4305-8993-57ee3f3f5654
Certfa Charming Kitten January 2021ATTACK:enterprise:S1201 → uses → ATTACK:enterprise:T1114
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6c175a3-40a7-4711-886f-c80cb6cd8360
Zscaler Kimsuky TRANSLATEXTATTACK:enterprise:M1060 → mitigates → ATTACK:enterprise:T1114
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bae85c8c-8b02-4a4c-8a38-c46f30c48274
TrustedSec OOB CommunicationsATTACK:enterprise:M1041 → mitigates → ATTACK:enterprise:T1114
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c15c9cbf-7ecc-4e2b-8fe1-636f381bac63
ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1114
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d60b92c6-2030-4802-8d7d-868ff15f3b0c
Microsoft Tim McMichael Exchange Mail Forwarding 2ATTACK:enterprise:T1114.001 → subtechnique-of → ATTACK:enterprise:T1114
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f4c8b1b6-8204-4cbd-be5b-f3a6080726e7
ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1114
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f9270fc0-7d9f-4380-bf78-1f79fa775455
CISA Scattered Spider Advisory November 2023