T1114Collection
Email Collection
Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or…
CVEs3
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.3
Reports0
Detections
4 Sigma rules tagged T1114Email CollectionT11144 general rules
- Exchange PowerShell Snap-Ins Usagehightest
- Hacktool Rulerhightest
- PST Export Alert Using eDiscovery Alertmediumtest
- PST Export Alert Using New-ComplianceSearchActionmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Email Collection
3 CVEs, by priority. Each link shows its badge.- CVE-2020-0688Microsoft Exchange Server Validation Key Remote Code Execution VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1505.003Web Shell+2 more · 3 reportsMITRE CTID mapping of the KEV entry · primary impact>99.9%Top 0.03%86.9priority
- CVE-2024-42009RoundCube Webmail Cross-Site Scripting VulnerabilityRoundcube · WebmailKEVPublic exploitCritical · 9.3T1566.002Spearphishing LinkT1056Input Capture+1 moreMITRE CTID mapping of the KEV entry · primary impact82.9%Top 0.33%69.4priority
- CVE-2024-27443Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) VulnerabilitySynacor · Zimbra Collaboration Suite (ZCS)KEVPublic exploitMedium · 6.1T1566.002Spearphishing LinkT1059.004Unix Shell+2 moreMITRE CTID mapping of the KEV entry · primary impact24.6%Top 2.1%66.8priority
Linked through a sub-technique
1 more- CVE-2012-0767Adobe Flash Player Cross-Site Scripting (XSS) VulnerabilityAdobe · Flash PlayerKEVEnd of lifeMedium · 6.1T1204.001Malicious LinkT1098Account Manipulation+2 more6.2%Top 6.5%46.0priority