T1114 — Email Collection

# T1114 - Email Collection

## SOC Recommendation
Any new mailbox forwarding rule, delegate grant, or bulk mailbox export activity following a suspicious sign-in should be treated as likely post-compromise collection, particularly when forwarding targets an external or unfamiliar address.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| File Analysis | Detect | Review inbox rules, forwarding configuration, and any exported mailbox content for signs of bulk collection. |
| Disable Remote Access | Harden | Remove delegate access and revoke API/IMAP grants tied to the mailbox. |
| Email Removal | Evict | Remove the forwarding rule and any exfiltrated-mail artifacts once confirmed malicious. |

## Investigation Steps
1. Review mailbox inbox rules for forwarding, redirect, or delete-on-arrival rules.
2. Check mailbox delegate and "send as"/"send on behalf" permission grants.
3. Review Exchange admin audit log for mailbox export or eDiscovery search activity.
4. Correlate with sign-in logs for the mailbox owner around the time the rule was created.

## Evidence to Collect
- Mailbox owner
- Rule/delegate configuration details
- Forwarding/redirect destination address
- Creation timestamp and initiating identity
- Volume of mail affected

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Revoke the user's SharePoint/OneDrive access pending investi | Medium | No | Yes |
| Preserve SharePoint audit logs | Low | No | Yes |
| Notify HR and Legal if insider threat confirmed | Low | Yes | No |
| Assess UK GDPR breach notification if personal data involved | Low | No | Yes |

## KQL
```kql
let lookback = 1d;
let InternalDomains = dynamic(["contoso.com"]); // update with tenant accepted domains
OfficeActivity
| where TimeGenerated >= ago(lookback)
| where OfficeWorkload =~ "Exchange"
| where Operation in~ ("New-InboxRule", "Set-InboxRule", "Set-Mailbox")
| extend ForwardTo = tostring(parse_json(tostring(Parameters))[0])
| where Operation in~ ("New-InboxRule", "Set-InboxRule")
    or (Operation =~ "Set-Mailbox" and Parameters has "ForwardingSmtpAddress")
| extend RuleParameters = tostring(Parameters)
| where RuleParameters has_any ("ForwardTo", "ForwardAsAttachmentTo", "RedirectTo", "ForwardingSmtpAddress")
| where not(RuleParameters has_any (InternalDomains))
| project
    TimeGenerated,
    UserId,
    Operation,
    RuleParameters,
    ClientIP
| extend timestamp = TimeGenerated, AccountCustomEntity = UserId
| order by TimeGenerated desc
```
```kql
let lookback = 1h;
let paymentKeywords = dynamic(["wire transfer", "urgent payment", "bank details", "swift", "iban", "payment today", "invoice update", "change of bank", "new account details"]);
let suspiciousEmails =
    EmailEvents
    | where TimeGenerated >= ago(lookback)
    | where Subject has_any (paymentKeywords) or EmailBody has_any (paymentKeywords)
    | where SenderFromDomain !endswith ".internal"
    | project NetworkMessageId, EmailTime = TimeGenerated, SenderFromAddress, SenderFromDomain, RecipientEmailAddress, Subject;
let suspiciousForwarding =
    OfficeActivity
    | where TimeGenerated >= ago(lookback)
    | where Operation in~ ("New-InboxRule", "Set-InboxRule", "Set-Mailbox")
    | where Parameters has_any ("ForwardTo", "ForwardingSmtpAddress", "RedirectTo", "DeliverToMailboxAndForward")
    | project RuleTime = TimeGenerated, UserId = tolower(UserId), Operation, Parameters;
suspiciousEmails
| extend RecipientKey = tolower(RecipientEmailAddress)
| join kind=inner suspiciousForwarding on $left.RecipientKey == $right.UserId
| where RuleTime between (EmailTime - 60m .. EmailTime + 60m)
| project
    TimeGenerated = coalesce(RuleTime, EmailTime),
    EmailTime,
    RuleTime,
    SenderFromAddress,
    SenderFromDomain,
    RecipientEmailAddress,
    Subject,
    Operation,
    Parameters,
    NetworkMessageId
| extend timestamp = TimeGenerated,
         AccountCustomEntity = RecipientEmailAddress
| order by TimeGenerated desc
```
```kql
// High Severity - Attack Surface - Misconfiguration Detected
let timeFrame = 5m;
CyfirmaASConfigurationAlerts_CL
| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
| extend
    Description=description,
    FirstSeen=first_seen,
    LastSeen=last_seen,
    RiskScore=risk_score,
    Domain=sub_domain,
    TopDomain=top_domain,
    NetworkIP=ip,
    AlertUID=alert_uid,
    UID=uid,
    Softwares=software,
    WebAppFirewall=web_app_firewall,
    ClickJackingDefence=click_jacking_defence,
    ContentSecurityPolicy=content_security_policy,
    CookieXssProtection=cookie_xss_protection,
    DataInjectionDefence=data_injection_defence,
    DomainStatus=domain_status,
    MissingEPPCodes=missing_epp_codes,
    SecureCookie=secure_cookie,
    SetCookieHttpsOnly=set_cookie_https_only,
    XFrameOptions=x_frame_options,
    X_XssProtection=x_xss_protection,
    ProviderName='CYFIRMA',
    ProductName='DeCYFIR/DeTCT'
| project
    TimeGenerated,
    Description,
    Domain,
    TopDomain,
    RiskScore,
    FirstSeen,
    LastSeen,
    NetworkIP,
    AlertUID,
    UID,
    Softwares,
    WebAppFirewall,
    ClickJackingDefence,
    ContentSecurityPolicy,
    CookieXssProtection,
    DataInjectionDefence,
    DomainStatus,
    MissingEPPCodes,
    SecureCookie,
    SetCookieHttpsOnly,
    XFrameOptions,
    X_XssProtection,
    ProviderName,
    ProductName
```

## Escalation Criteria
- Forwarding destination is an external, unfamiliar domain.
- Executive or finance mailbox affected.
- Large volume of mail already exposed before detection.
- Rule created immediately after a suspicious sign-in.

## False Positive Considerations
- User-created forwarding rule to a personal secondary account (with consent).
- Approved shared-mailbox delegate configuration.
- Legal hold / eDiscovery export performed by authorized compliance staff.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1114.json
• /api/recommendations/T1114.json
• /api/d3fend/T1114.json
• /api/mappings/T1114.json
• /api/confluence/T1114.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1114.json

Response:

{
  "technique_id": "T1114",
  "name": "Email Collection",
  "priority": "medium",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Collection"
  ],
  "platforms": [
    "Office 365",
    "SaaS"
  ],
  "summary": "Adversaries may target a mailbox to collect sensitive information — via mailbox forwarding rules, delegate access, or direct API/IMAP access — often after an initial account compromise, to support further targeting or data theft.\n",
  "soc_recommendation": "Any new mailbox forwarding rule, delegate grant, or bulk mailbox export activity following a suspicious sign-in should be treated as likely post-compromise collection, particularly when forwarding targets an external or unfamiliar address.\n",
  "d3fend_mappings": [
    {
      "id": "D3-FA",
      "name": "File Analysis",
      "relationship": "detect",
      "practical_action": "Review inbox rules, forwarding configuration, and any exported mailbox content for signs of bulk collection.\n",
      "tooling": [
        "Exchange Online",
        "Defender for Office 365"
      ]
    },
    {
      "id": "D3-DRA",
      "name": "Disable Remote Access",
      "relationship": "harden",
      "practical_action": "Remove delegate access and revoke API/IMAP grants tied to the mailbox.",
      "tooling": [
        "Entra ID",
        "Exchange Online"
      ]
    },
    {
      "id": "D3-ER",
      "name": "Email Removal",
      "relationship": "evict",
      "practical_action": "Remove the forwarding rule and any exfiltrated-mail artifacts once confirmed malicious.",
      "tooling": [
        "Microsoft Graph",
        "Exchange Online"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review mailbox inbox rules for forwarding, redirect, or delete-on-arrival rules.",
      "Check mailbox delegate and \"send as\"/\"send on behalf\" permission grants.",
      "Review Exchange admin audit log for mailbox export or eDiscovery search activity.",
      "Correlate with sign-in logs for the mailbox owner around the time the rule was created."
    ],
    "generic": [
      "Identify the exact rule, delegate, or export mechanism in use.",
      "Determine the destination (external address, another mailbox) of any forwarded/exported mail.",
      "Check how long the rule/delegate access has existed and how much mail has already been exposed.",
      "Real detection reference: \"Mailbox Forwarding Rule to External Domain\" -- Flags creation of inbox rules or mailbox-level forwarding that redirects mail to an external domain."
    ]
  },
  "evidence_to_collect": [
    "Mailbox owner",
    "Rule/delegate configuration details",
    "Forwarding/redirect destination address",
    "Creation timestamp and initiating identity",
    "Volume of mail affected"
  ],
  "response_actions": [
    {
      "name": "Revoke the user's SharePoint/OneDrive access pending investi",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Revoke the user's SharePoint/OneDrive access pending investigation"
    },
    {
      "name": "Preserve SharePoint audit logs",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Notify HR and Legal if insider threat confirmed",
      "category": "Response",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide"
    },
    {
      "name": "Assess UK GDPR breach notification if personal data involved",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-CO-003 — Mailbox Forwarding Rule to External Domain",
        "description": "Flags creation of inbox rules or mailbox-level forwarding that redirects mail to an external domain. (Source: Bell Integration baseline detection library, mapped via sub-technique T1114.003.)",
        "query": "let lookback = 1d;\nlet InternalDomains = dynamic([\"contoso.com\"]); // update with tenant accepted domains\nOfficeActivity\n| where TimeGenerated >= ago(lookback)\n| where OfficeWorkload =~ \"Exchange\"\n| where Operation in~ (\"New-InboxRule\", \"Set-InboxRule\", \"Set-Mailbox\")\n| extend ForwardTo = tostring(parse_json(tostring(Parameters))[0])\n| where Operation in~ (\"New-InboxRule\", \"Set-InboxRule\")\n    or (Operation =~ \"Set-Mailbox\" and Parameters has \"ForwardingSmtpAddress\")\n| extend RuleParameters = tostring(Parameters)\n| where RuleParameters has_any (\"ForwardTo\", \"ForwardAsAttachmentTo\", \"RedirectTo\", \"ForwardingSmtpAddress\")\n| where not(RuleParameters has_any (InternalDomains))\n| project\n    TimeGenerated,\n    UserId,\n    Operation,\n    RuleParameters,\n    ClientIP\n| extend timestamp = TimeGenerated, AccountCustomEntity = UserId\n| order by TimeGenerated desc"
      },
      {
        "name": "GEN-IM-016 — Financial Theft - BEC With Forwarding Rule",
        "description": "Correlates payment-lure email with suspicious forwarding/redirect rules, keeping this distinct from IM-011's payment-detail-change surge detector. (Source: Bell Integration baseline detection library, mapped via sub-technique T1114.003.)",
        "query": "let lookback = 1h;\nlet paymentKeywords = dynamic([\"wire transfer\", \"urgent payment\", \"bank details\", \"swift\", \"iban\", \"payment today\", \"invoice update\", \"change of bank\", \"new account details\"]);\nlet suspiciousEmails =\n    EmailEvents\n    | where TimeGenerated >= ago(lookback)\n    | where Subject has_any (paymentKeywords) or EmailBody has_any (paymentKeywords)\n    | where SenderFromDomain !endswith \".internal\"\n    | project NetworkMessageId, EmailTime = TimeGenerated, SenderFromAddress, SenderFromDomain, RecipientEmailAddress, Subject;\nlet suspiciousForwarding =\n    OfficeActivity\n    | where TimeGenerated >= ago(lookback)\n    | where Operation in~ (\"New-InboxRule\", \"Set-InboxRule\", \"Set-Mailbox\")\n    | where Parameters has_any (\"ForwardTo\", \"ForwardingSmtpAddress\", \"RedirectTo\", \"DeliverToMailboxAndForward\")\n    | project RuleTime = TimeGenerated, UserId = tolower(UserId), Operation, Parameters;\nsuspiciousEmails\n| extend RecipientKey = tolower(RecipientEmailAddress)\n| join kind=inner suspiciousForwarding on $left.RecipientKey == $right.UserId\n| where RuleTime between (EmailTime - 60m .. EmailTime + 60m)\n| project\n    TimeGenerated = coalesce(RuleTime, EmailTime),\n    EmailTime,\n    RuleTime,\n    SenderFromAddress,\n    SenderFromDomain,\n    RecipientEmailAddress,\n    Subject,\n    Operation,\n    Parameters,\n    NetworkMessageId\n| extend timestamp = TimeGenerated,\n         AccountCustomEntity = RecipientEmailAddress\n| order by TimeGenerated desc"
      },
      {
        "name": "30206b45-75d2-4c6a-87c5-f0861c1f2870 — CYFIRMA - Attack Surface - Configuration High Rule",
        "description": "This alert is generated when CYFIRMA detects a critical misconfiguration in a public-facing asset or service. Such misconfigurations may include exposed admin interfaces, default credentials, open directory listings, or insecure protocols, which significantly increase the attack surface.\" (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "// High Severity - Attack Surface - Misconfiguration Detected\nlet timeFrame = 5m;\nCyfirmaASConfigurationAlerts_CL\n| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())\n| extend\n    Description=description,\n    FirstSeen=first_seen,\n    LastSeen=last_seen,\n    RiskScore=risk_score,\n    Domain=sub_domain,\n    TopDomain=top_domain,\n    NetworkIP=ip,\n    AlertUID=alert_uid,\n    UID=uid,\n    Softwares=software,\n    WebAppFirewall=web_app_firewall,\n    ClickJackingDefence=click_jacking_defence,\n    ContentSecurityPolicy=content_security_policy,\n    CookieXssProtection=cookie_xss_protection,\n    DataInjectionDefence=data_injection_defence,\n    DomainStatus=domain_status,\n    MissingEPPCodes=missing_epp_codes,\n    SecureCookie=secure_cookie,\n    SetCookieHttpsOnly=set_cookie_https_only,\n    XFrameOptions=x_frame_options,\n    X_XssProtection=x_xss_protection,\n    ProviderName='CYFIRMA',\n    ProductName='DeCYFIR/DeTCT'\n| project\n    TimeGenerated,\n    Description,\n    Domain,\n    TopDomain,\n    RiskScore,\n    FirstSeen,\n    LastSeen,\n    NetworkIP,\n    AlertUID,\n    UID,\n    Softwares,\n    WebAppFirewall,\n    ClickJackingDefence,\n    ContentSecurityPolicy,\n    CookieXssProtection,\n    DataInjectionDefence,\n    DomainStatus,\n    MissingEPPCodes,\n    SecureCookie,\n    SetCookieHttpsOnly,\n    XFrameOptions,\n    X_XssProtection,\n    ProviderName,\n    ProductName"
      }
    ],
    "spl": [
      {
        "name": "Mailbox forwarding rule changes",
        "description": "Review mailbox rule creation events in Splunk.",
        "query": "index=o365 operation=\"New-InboxRule\" earliest=-7d\n"
      }
    ],
    "esql": [
      {
        "name": "ec8efb0c-604d-42fa-ac46-ed1cfbc38f78 — M365 Exchange Inbox Forwarding Rule Created",
        "description": "(EQL) Identifies when a new Inbox forwarding rule is created in Microsoft 365. Inbox rules process messages in the Inbox based on conditions and take actions. In this case, the rules will forward the emails to a defined address. Attackers can abuse Inbox Rules to intercept and exfiltrate email data without making organization-wide configuration changes or having the corresponding privileges. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "web where\n    event.provider == \"Exchange\" and\n    event.action in (\n        \"New-InboxRule\",\n        \"Set-InboxRule\",\n        \"Set-Mailbox\",\n        \"Set-TransportRule\",\n        \"New-TransportRule\"\n    ) and event.outcome == \"success\" and\n    (\n        (?o365.audit.Parameters.ForwardTo != null and not endsWith~(?o365.audit.Parameters.ForwardTo, user.domain)) or\n        (?o365.audit.Parameters.ForwardAsAttachmentTo != null and not endsWith~(?o365.audit.Parameters.ForwardAsAttachmentTo, user.domain)) or\n        (?o365.audit.Parameters.ForwardingAddress != null and not endsWith~(?o365.audit.Parameters.ForwardingAddress, user.domain)) or\n        (?o365.audit.Parameters.ForwardingSmtpAddress != null and not endsWith~(?o365.audit.Parameters.ForwardingSmtpAddress, user.domain)) or\n        (?o365.audit.Parameters.RedirectTo != null and not endsWith~(?o365.audit.Parameters.RedirectTo, user.domain)) or\n        (?o365.audit.Parameters.RedirectToRecipients != null and not endsWith~(?o365.audit.Parameters.RedirectToRecipients, user.domain)) or\n        (?o365.audit.Parameters.RedirectMessageTo != null and not endsWith~(?o365.audit.Parameters.RedirectMessageTo, user.domain)) or\n        (?o365.audit.Parameters.BlindCopyTo != null and not endsWith~(?o365.audit.Parameters.BlindCopyTo, user.domain))\n    )"
      },
      {
        "name": "1dee0500-4aeb-44ca-b24b-4a285d7b6ba1 — Suspicious Inter-Process Communication via Outlook",
        "description": "(EQL) Detects Inter-Process Communication with Outlook via Component Object Model from an unusual process. Adversaries may target user email to collect sensitive information or send email on their behalf via API. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "sequence with maxspan=1m\n[process where host.os.type == \"windows\" and event.action == \"start\" and\n  (\n    process.name : (\n      \"rundll32.exe\", \"mshta.exe\", \"powershell.exe\", \"pwsh.exe\",\n      \"cmd.exe\", \"regsvr32.exe\", \"cscript.exe\", \"wscript.exe\"\n    ) or\n    (\n      (process.code_signature.trusted == false or process.code_signature.exists == false) and\n      (process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500)\n    )\n  )\n] by process.entity_id\n[process where host.os.type == \"windows\" and event.action == \"start\" and process.name : \"OUTLOOK.EXE\" and\n  process.Ext.effective_parent.name != null] by process.Ext.effective_parent.entity_id"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Remove a confirmed-malicious forwarding rule.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Notify affected external recipients.",
      "Disable the mailbox owner's account."
    ]
  },
  "escalation_criteria": [
    "Forwarding destination is an external, unfamiliar domain.",
    "Executive or finance mailbox affected.",
    "Large volume of mail already exposed before detection.",
    "Rule created immediately after a suspicious sign-in."
  ],
  "false_positive_considerations": [
    "User-created forwarding rule to a personal secondary account (with consent).",
    "Approved shared-mailbox delegate configuration.",
    "Legal hold / eDiscovery export performed by authorized compliance staff."
  ],
  "confluence": {
    "title": "T1114 - Email Collection Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}