T1114.002 - Remote Email Collection - MITRE ATT&CK

T1114.002 - Remote Email Collection

Sub-technique

Tattiche:
Collection

Piattaforme:
Windows Office Suite

Rilevamento:
Not specified

Description:

Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords.