# T1114 - Email Collection

## SOC Recommendation
Any new mailbox forwarding rule, delegate grant, or bulk mailbox export activity following a suspicious sign-in should be treated as likely post-compromise collection, particularly when forwarding targets an external or unfamiliar address.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| File Analysis | Detect | Review inbox rules, forwarding configuration, and any exported mailbox content for signs of bulk collection. |
| Disable Remote Access | Harden | Remove delegate access and revoke API/IMAP grants tied to the mailbox. |
| Email Removal | Evict | Remove the forwarding rule and any exfiltrated-mail artifacts once confirmed malicious. |

## Investigation Steps
1. Review mailbox inbox rules for forwarding, redirect, or delete-on-arrival rules.
2. Check mailbox delegate and "send as"/"send on behalf" permission grants.
3. Review Exchange admin audit log for mailbox export or eDiscovery search activity.
4. Correlate with sign-in logs for the mailbox owner around the time the rule was created.

## Evidence to Collect
- Mailbox owner
- Rule/delegate configuration details
- Forwarding/redirect destination address
- Creation timestamp and initiating identity
- Volume of mail affected

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Revoke the user's SharePoint/OneDrive access pending investi | Medium | No | Yes |
| Preserve SharePoint audit logs | Low | No | Yes |
| Notify HR and Legal if insider threat confirmed | Low | Yes | No |
| Assess UK GDPR breach notification if personal data involved | Low | No | Yes |

## KQL
```kql
let lookback = 1d;
let InternalDomains = dynamic(["contoso.com"]); // update with tenant accepted domains
OfficeActivity
| where TimeGenerated >= ago(lookback)
| where OfficeWorkload =~ "Exchange"
| where Operation in~ ("New-InboxRule", "Set-InboxRule", "Set-Mailbox")
| extend ForwardTo = tostring(parse_json(tostring(Parameters))[0])
| where Operation in~ ("New-InboxRule", "Set-InboxRule")
    or (Operation =~ "Set-Mailbox" and Parameters has "ForwardingSmtpAddress")
| extend RuleParameters = tostring(Parameters)
| where RuleParameters has_any ("ForwardTo", "ForwardAsAttachmentTo", "RedirectTo", "ForwardingSmtpAddress")
| where not(RuleParameters has_any (InternalDomains))
| project
    TimeGenerated,
    UserId,
    Operation,
    RuleParameters,
    ClientIP
| extend timestamp = TimeGenerated, AccountCustomEntity = UserId
| order by TimeGenerated desc
```
```kql
let lookback = 1h;
let paymentKeywords = dynamic(["wire transfer", "urgent payment", "bank details", "swift", "iban", "payment today", "invoice update", "change of bank", "new account details"]);
let suspiciousEmails =
    EmailEvents
    | where TimeGenerated >= ago(lookback)
    | where Subject has_any (paymentKeywords) or EmailBody has_any (paymentKeywords)
    | where SenderFromDomain !endswith ".internal"
    | project NetworkMessageId, EmailTime = TimeGenerated, SenderFromAddress, SenderFromDomain, RecipientEmailAddress, Subject;
let suspiciousForwarding =
    OfficeActivity
    | where TimeGenerated >= ago(lookback)
    | where Operation in~ ("New-InboxRule", "Set-InboxRule", "Set-Mailbox")
    | where Parameters has_any ("ForwardTo", "ForwardingSmtpAddress", "RedirectTo", "DeliverToMailboxAndForward")
    | project RuleTime = TimeGenerated, UserId = tolower(UserId), Operation, Parameters;
suspiciousEmails
| extend RecipientKey = tolower(RecipientEmailAddress)
| join kind=inner suspiciousForwarding on $left.RecipientKey == $right.UserId
| where RuleTime between (EmailTime - 60m .. EmailTime + 60m)
| project
    TimeGenerated = coalesce(RuleTime, EmailTime),
    EmailTime,
    RuleTime,
    SenderFromAddress,
    SenderFromDomain,
    RecipientEmailAddress,
    Subject,
    Operation,
    Parameters,
    NetworkMessageId
| extend timestamp = TimeGenerated,
         AccountCustomEntity = RecipientEmailAddress
| order by TimeGenerated desc
```
```kql
// High Severity - Attack Surface - Misconfiguration Detected
let timeFrame = 5m;
CyfirmaASConfigurationAlerts_CL
| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
| extend
    Description=description,
    FirstSeen=first_seen,
    LastSeen=last_seen,
    RiskScore=risk_score,
    Domain=sub_domain,
    TopDomain=top_domain,
    NetworkIP=ip,
    AlertUID=alert_uid,
    UID=uid,
    Softwares=software,
    WebAppFirewall=web_app_firewall,
    ClickJackingDefence=click_jacking_defence,
    ContentSecurityPolicy=content_security_policy,
    CookieXssProtection=cookie_xss_protection,
    DataInjectionDefence=data_injection_defence,
    DomainStatus=domain_status,
    MissingEPPCodes=missing_epp_codes,
    SecureCookie=secure_cookie,
    SetCookieHttpsOnly=set_cookie_https_only,
    XFrameOptions=x_frame_options,
    X_XssProtection=x_xss_protection,
    ProviderName='CYFIRMA',
    ProductName='DeCYFIR/DeTCT'
| project
    TimeGenerated,
    Description,
    Domain,
    TopDomain,
    RiskScore,
    FirstSeen,
    LastSeen,
    NetworkIP,
    AlertUID,
    UID,
    Softwares,
    WebAppFirewall,
    ClickJackingDefence,
    ContentSecurityPolicy,
    CookieXssProtection,
    DataInjectionDefence,
    DomainStatus,
    MissingEPPCodes,
    SecureCookie,
    SetCookieHttpsOnly,
    XFrameOptions,
    X_XssProtection,
    ProviderName,
    ProductName
```

## Escalation Criteria
- Forwarding destination is an external, unfamiliar domain.
- Executive or finance mailbox affected.
- Large volume of mail already exposed before detection.
- Rule created immediately after a suspicious sign-in.

## False Positive Considerations
- User-created forwarding rule to a personal secondary account (with consent).
- Approved shared-mailbox delegate configuration.
- Legal hold / eDiscovery export performed by authorized compliance staff.

Generated by SOC Response Atlas by Basyrix.