T1114.002 — Remote Email Collection

Tactic: Collection · Platforms: Office Suite, Windows

Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing…

Sub-technique of Email Collection (T1114).

Sigma detection rules (2)

T1114.002 Email Collection: Remote Email Collection

title: "T1114.002 Email Collection: Remote Email Collection"
id: 8f70cda4-c540-47fa-8cce-a8e61b12f6e6
description: 'Detects MailSniper and Exchange/EWS cmdlets used to remotely search/export mailbox content. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: UserAgentPattern, TimeWindow, KnownIPLocations, PrivilegedUserList.'
references:
  - https://attack.mitre.org/techniques/T1114/002
author: Shahrukh Khan
date: 2026-06-27
license: MIT
tags:
  - attack.collection
  - attack.t1114.002

logsource:
  category: process_creation
  product: windows

detection:
  selection_mailsniper:
    CommandLine|contains:
      - 'MailSniper'
      - 'Invoke-GlobalMailSearch'
      - 'Invoke-SelfSearch'
      - 'Invoke-DomainHarvestOWA'
      - 'Get-GlobalAddressList'
  selection_exchange_snapin:
    CommandLine|contains|all:
      - 'Add-PSSnapin'
      - 'Microsoft.Exchange.Management.PowerShell'
  selection_mailbox_export:
    CommandLine|contains:
      - 'New-MailboxExportRequest'
      - 'Search-Mailbox'
  condition: 1 of selection_*

falsepositives:
  - Legitimate eDiscovery/migration admin activity.

level: medium

T1114.002 Email Collection: Remote Email Collection

title: "T1114.002 Email Collection: Remote Email Collection"
id: f2fbf645-0fd3-4c4d-8d28-ec8df4503cd6
description: 'Detect Remote Email Collection via Abnormal Login and Programmatic Access. The curl/imap selection now checks the IMAP/POP3 scheme across a1, a2, and a3 instead of assuming it always lands in a1, since common invocations with preceding flags (e.g. curl -s -k imap://...) shift the URL''s argv position. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: MailAccessVolumeThreshold, OAuthClientIDAllowList, KeywordSearchFrequency, LoginGeolocationVariance.'
references:
  - https://attack.mitre.org/techniques/T1114/002
author: Shahrukh Khan
date: 2026-05-17
license: MIT
tags:
  - attack.collection
  - attack.t1114.002

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_mutt:
    type: EXECVE
    a0|endswith:
      - '/mutt'
      - '/fetchmail'
      - '/mbsync'
  selection_curl_imap:
    - type: EXECVE
      a0|endswith: '/curl'
      a1|contains:
        - 'imap://'
        - 'imaps://'
        - 'pop3://'
    - type: EXECVE
      a0|endswith: '/curl'
      a2|contains:
        - 'imap://'
        - 'imaps://'
        - 'pop3://'
    - type: EXECVE
      a0|endswith: '/curl'
      a3|contains:
        - 'imap://'
        - 'imaps://'
        - 'pop3://'

  condition: 1 of selection_*

falsepositives:
  - Legitimate mail synchronization clients and scripted mailbox backups run by users or administrators on a scheduled basis, including curl invocations with additional flags before the IMAP/POP3 URL.

level: medium

Related sub-techniques

Explore