T1114 Email Collection
EnterpriseAdversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-techniques (3)
More specific entries beneath this one.
mitigations
ATT&CK mitigations that reduce this.
detected by (7)
Data components that detect this.
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.AAIdentity Management, Authentication, and Access Controlmoderate · backed by 6 of 15 mapped controls
- DE.CMContinuous Monitoringmoderate · backed by 5 of 15 mapped controls
- PR.DSData Securitymoderate · backed by 5 of 15 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (15)
Security controls that mitigate this.
known-exploited CVEs (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-27443US | medium6.1OT critical | KEV | ||
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic us… | ||||
| CVE-2024-42009US | critical9.3OT critical | KEV | ||
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message t… | ||||
| CVE-2020-0688US | high8.8OT critical | KEV | ||
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption… | ||||
groups (4)
Threat groups associated with this.
software (2)
Malware and tools associated with this.
Detected by (Sigma) (4)
Sigma detection rules related to this.
source
Where this definition is published.