T1114

Email Collection

Index entry

In-depth coverage of this technique (how it looks in telemetry, how to hunt it, and how to rule out benign activity) is coming soon. It's in our catalog and on the roadmap to be written up.

View this technique on MITRE ATT&CK →

Telemetry needed

The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.

Entra ID audit logs
- SignInEvents
Linux audit framework (auditd)
- SYSCALL:open SYSCALL record for open
osquery (Linux)
- process_events
syslog / journald (auth, secure, messages, cron) (the log as a whole)
Microsoft 365 Unified Audit Log
- New-InboxRule
- Set-Mailbox
macOS Endpoint Security framework events
- es_event_exec
- es_event_open
macOS unified log (the log as a whole)
Windows Application event log (the log as a whole)
PowerShell logging
- 4103 Module logging (pipeline execution)
- 4104 Script block logging (script block text)
- 4105 Script block invocation started
- 4106 Script block invocation completed
Windows Security event log
- 5145 Network Share Checked
Sysmon
- 22 DNSEvent (DNS query)
- 3 Network connection

Practice it

1 scenario in this catalog covers T1114. We don't name it, because identifying the technique is part of what a scenario grades. Explore the Range →