T1114.002_remote-email-collection

T1114.002 Remote Email Collection

Sub-technique of: T1114

High-Level Description

Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as MailSniper can be used to automate searches for specific keywords.

Kill Chain Phase

• Collection (TA0009)

Platforms: Windows, Office Suite

What to Check

• Identify if Remote Email Collection technique is applicable to target environment
• Check Windows systems for indicators of Remote Email Collection
• Check Office Suite systems for indicators of Remote Email Collection
• Verify mitigations are bypassed or absent (3 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to Remote Email Collection by examining the target platforms (Windows, Office Suite).

2. Assess Existing Defenses: Review whether mitigations for T1114.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1060 Out-of-Band Communications Channel

Use secure out-of-band authentication methods to verify the authenticity of critical actions initiated via email, such as password resets, financial transactions, or access requests.

For highly sensitive information, utilize out-of-band communication channels instead of relying solely on email. This reduces the risk of sensitive data being collected through compromised email accounts.

Set up out-of-band alerts to notify security teams of unusual email activities, such as mass forwarding or large attachments being sent, which could indicate email collection attempts.

Create plans for leveraging a secure out-of-band communications channel, rather than an existing in-network email server, in case of a security incident.

M1041 Encrypt Sensitive Information

Use of encryption provides an added layer of security to sensitive information sent over email. Encryption using public key cryptography requires the adversary to obtain the private certificate along with an encryption key to decrypt messages.

M1032 Multi-factor Authentication

Use of multi-factor authentication for public-facing webmail servers is a recommended best practice to minimize the usefulness of usernames and passwords to adversaries.

Detection

Detect Remote Email Collection via Abnormal Login and Programmatic Access

Risk Assessment

CWE Categories

References

• Atomic Red Team - T1114.002
• MITRE ATT&CK - T1114.002