---
{
  "title": "Email Collection",
  "summary": "Email collection accesses messages or mailbox data that may contain sensitive business and recovery information.",
  "topic": "soc",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    6
  ],
  "aliases": [
    "T1114"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1114: Email Collection",
      "url": "https://attack.mitre.org/techniques/T1114"
    }
  ],
  "editorialVersion": 2
}
---

## Mailboxes contain more than messages

Email collection accesses messages or mailbox information that may reveal business conversations, attachments, contacts, recovery links, and other sensitive material. Access can occur through a mail client, a service interface, an application grant, or forwarding behavior, depending on the environment.

A successful account sign-in is not the same as confirmed access to every message. Investigators should determine which mailbox actions are recorded, which permissions were available, and what the evidence can establish about retrieval or forwarding.

## An unexpected forwarding rule appears

At a fictional academy, a staff member reports correspondence reaching an unfamiliar external address. The responder reviews mailbox rule changes, the creating principal, forwarding configuration, relevant authentication, and available message-flow records.

An approved shared-workflow rule could explain forwarding, but the destination and scope should match the business purpose. Contact the owner through a trusted channel rather than relying on messages from the potentially compromised account.

The team checks whether the rule was merely configured or whether messages were actually forwarded. Message-flow evidence may support delivery details, while mailbox access records may answer different questions. Keep those conclusions separate.

## Trace every access path

Review delegated mailbox permissions, connected applications, service credentials, and active sessions where relevant. Changing the user's password may not revoke every grant or session under the provider's behavior. The actual access path determines the required response.

Mailboxes often contain personal and confidential material unrelated to the incident. Collect and inspect only what the authorized investigation requires, using controlled storage. A broad export for convenience can create an additional sensitive evidence set.

[[account-manipulation]] helps explain unauthorized permission or credential changes. [[sessions-and-cookies]] provides session context, while [[cloud-audit-logs]] explains why configuration and content-access records may have different coverage.

## Scope impact honestly

If records establish a forwarding window, identify the messages or categories supported by the evidence. If detailed access logging was unavailable, state that limitation rather than claiming either complete exposure or complete safety. An actor's ability to access mail and proof of particular message access are distinct.

Preserve rules and relevant events before removing unauthorized configuration where practical. Restrict the abused identity or grant, review related accounts, and verify that the unwanted forwarding or access has stopped.

For practice, compare an approved departmental forwarding rule with a fictional rule created after an unexplained sign-in. Identify the creation, authorization, message-flow, and access evidence needed for a decision. [[incident-response]] coordinates containment, while [[incident-reporting]] keeps the distinction between possible exposure and confirmed collection clear.

## Related concepts

- [[mitre-attack]]
- [[logs-and-telemetry]]