{
  "technique_id": "T1114",
  "name": "Email Collection",
  "tactics": [
    "Collection"
  ],
  "platforms": [
    "Office 365",
    "SaaS"
  ],
  "summary": "Adversaries may target a mailbox to collect sensitive information — via mailbox forwarding rules, delegate access, or direct API/IMAP access — often after an initial account compromise, to support further targeting or data theft.\n",
  "generated_by": "SOC Response Atlas by Basyrix"
}