Email is where contracts, invoices, password reset links, secrets pasted in a hurry and the incident response team's own discussions all end up, so reading someone's mailbox is often the fastest way to understand and exploit an organisation. MITRE ATT&CK tracks this as T1114 Email Collection in the Collection tactic (TA0009), with three sub-techniques in v20: Local Email Collection, Remote Email Collection and Email Forwarding Rule. This guide explains the technique at the level ATT&CK describes it, then focuses on defence: the detection strategies MITRE maps, the Microsoft 365 audit events that show mailbox access, external forwarding controls, and how to stop OAuth applications reading every mailbox in the tenant. It is for Microsoft 365 and Google Workspace administrators, detection engineers and incident responders.
Key takeaways
- Three routes, three controls. Local mail files need endpoint monitoring, remote access needs identity and app controls, and forwarding rules need tenant policy plus rule auditing.
- Applications read mail without MFA. An app holding the
Mail.Readapplication permission, or the Exchangefull_access_as_approle, can read every mailbox with no user signed in, so app credentials are mailbox credentials. - Forwarding rules survive password resets. ATT&CK notes that a rule keeps sending mail after credentials are changed, so every account recovery must include a rule and forwarding review.
- Block external auto-forwarding explicitly. In Microsoft 365 set the outbound spam policy to Off rather than leaving it on Automatic, and allow exceptions by remote domain.
- MailItemsAccessed scopes the damage. It records sync and bind access by protocol and session, which is what lets you say which messages an intruder could have read.
How the attack works
ATT&CK describes T1114 as adversaries targeting user email to collect sensitive information such as trade secrets or personal data, and notes that email may also reveal details of ongoing incident response, letting adversaries adjust to keep access. Collection can happen from mail servers or from clients.
| ID | Name (ATT&CK v20) | What happens, defender's view | Platforms |
|---|---|---|---|
| T1114.001 | Local Email Collection | Outlook data files (.ost, .pst) copied from AppData\Local\Microsoft\Outlook or Documents\Outlook Files on a compromised endpoint | Windows |
| T1114.002 | Remote Email Collection | Exchange, Microsoft 365 or Google Workspace mail read with stolen credentials or access tokens, often with scripted keyword searches | Office Suite, Windows |
| T1114.003 | Email Forwarding Rule | Inbox rules, mailbox forwarding or organisation-wide transport rules that copy mail to another recipient; rules can be hidden from Outlook and most admin tools by editing MAPI properties | Linux, macOS, Office Suite, Windows |
Related techniques often appear in the same intrusion: T1564.008 Email Hiding Rules (rules that move or delete security alerts and replies), T1098.002 Additional Email Delegate Permissions, T1528 Steal Application Access Token and T1534 Internal Spearphishing from the compromised mailbox. Business email compromise ends in T1657 Financial Theft. The response steps are in the Business Email Compromise Response Playbook; this page covers detection and prevention.
Where it shows up
- Nation-state espionage through apps: in the Microsoft Midnight Blizzard Breach, a password spray on a legacy test tenant account without MFA led to a legacy OAuth app, new malicious apps and the
full_access_as_approle, used to read senior leadership, security and legal mailboxes. ATT&CK links APT29 and the SolarWinds campaign (C0024) to T1114.002. - Dormant mail-reading service principals: in the Malwarebytes Breach 2021, attackers added a self-signed certificate to a dormant email protection app that still had mail read permission, then requested mail through Microsoft Graph.
- Business email compromise: attackers who phish a finance user add rules that forward or hide invoice threads, then reply from the real mailbox. ATT&CK links Scattered Spider, LAPSUS$, Star Blizzard and Kimsuky to T1114.003. See the Email Identity and BEC Guide.
- Consent phishing: users are tricked into granting a malicious app delegated mail scopes, which gives persistent access through refresh tokens. See the Consent Phishing and Illicit OAuth Grants Guide.
- Endpoint intrusions: ATT&CK lists 21 groups and campaigns for T1114.001, including Chimera, Sea Turtle and MirrorFace, typically taking Outlook data files during wider collection.
Impact
- Fraud: forwarded and hidden threads let attackers time payment redirection precisely.
- Intelligence: executive, legal and security mailboxes reveal strategy, negotiations and what defenders know.
- Credential harvest: secrets, reset links and MFA enrolment emails turn mail access into wider access. In the Midnight Blizzard case, stolen emails included secrets shared between Microsoft and its customers.
- Response compromise: an intruder reading the incident thread sees each containment step coming.
Detection
The table lists the ATT&CK v20 detection strategies for T1114, read from the official v20 dataset. See the ATT&CK Detection Strategies and Analytics Guide for how to use strategies and analytics.
| Technique | Detection strategy | Behaviour to detect | Log sources named by MITRE |
|---|---|---|---|
| T1114 | DET0476 Email Collection via Local Email Access and Auto-Forwarding Behavior | Forwarding rule creation or X-MS-Exchange-Organization-AutoForwarded headers correlated with suspicious processes, mail file access and connections to external SMTP servers | M365 unified audit Set-Mailbox, New-InboxRule; message trace; Entra sign-ins; PowerShell 4103 and 4104; Sysmon 3 and 22 |
| T1114.001 | DET0047 Detect Local Email Collection via Outlook Data File Access and Command Line Tooling | Directory enumeration, then reads of .pst or .ost by processes other than Outlook, optional compression, then network transfer | Security 4656, 4663, 4670; Sysmon 1, 11, 3 and 22 |
| T1114.002 | DET0048 Detect Remote Email Collection via Abnormal Login and Programmatic Access | Sign-ins from scripting tools or unusual locations, OAuth token misuse, unusual MailItemsAccessed patterns, scripted searches and eDiscovery requests | Entra sign-in logs; Purview MailItemsAccessed; unified audit Search-Mailbox, eDiscovery |
| T1114.003 | DET0576 Email Forwarding Rule Abuse Detection Across Platforms | New or changed inbox and transport rules with forward, redirect or auto-forward properties, by cmdlet or client | Unified audit New-InboxRule, Set-InboxRule; message trace auto-forward header; PowerShell logs; Apple Mail and Thunderbird rule files |
Microsoft 365 events to collect
| Event or report | What it shows | Notes from Microsoft documentation |
|---|---|---|
MailItemsAccessed | Mail read by POP, IMAP, MAPI, EWS, Exchange ActiveSync and REST, with MailAccessType Sync or Bind, ClientIPAddress, ClientInfoString, SessionId and Logon_type | Part of Audit (Standard), on by default for E3 and E5 users. A Sync event covers a whole folder; Bind events are aggregated per two minutes. An attacker who syncs and then reads offline leaves no further trace |
New-InboxRule, Set-InboxRule, UpdateInboxRules | Rules created or changed in Outlook on the web (first two) or in the Outlook client (third) | Alert on rules that forward, redirect, delete or move to RSS Feeds, Archive or similar rarely viewed folders |
Set-Mailbox with forwarding parameters | Admin-set SMTP forwarding | Rare in most tenants, so any external value is high-signal |
Add-MailboxPermission | FullAccess granted to a delegate | Links to T1098.002 |
| Auto forwarded messages report | Which users are forwarding externally | Microsoft's recommended way to find cloud mailbox forwarding |
| Entra audit: consent and credential changes | App consent grants, new secrets or certificates on service principals, app role assignments | The Malwarebytes and Midnight Blizzard chains both show up here first |
Analytic patterns
- Rule after risky sign-in: an inbox rule created within an hour of a sign-in from a new country, ASN or device is the classic BEC signal.
- Keyword rules: rules matching terms such as invoice, payment, wire, password or security, or the names of the security team, deserve immediate review.
- App reads without users:
MailItemsAccessedby an application identity across many mailboxes, or by a new application, especially after a credential was added to it. - Volume per session: Sync events across many folders, or bind counts far above the user's baseline, in one session.
- Local file theft: any non-Outlook process reading or copying
.ostor.pstfiles, followed by archive creation.
Prevention and hardening
| Mitigation | Sub-techniques | Concrete action |
|---|---|---|
| M1032 Multi-factor Authentication | Parent, .002 | Phishing-resistant MFA for all mailbox users, legacy authentication blocked, and no MFA gaps in test or secondary tenants |
| M1042 Disable or Remove Feature or Program | .003 | Disable external automatic forwarding by default; allow named partner domains by exception |
| M1047 Audit | Parent, .003 | Regularly review inbox, forwarding and transport rules; MITRE cites Get-InboxRule, Remove-InboxRule, Get-TransportRule and Remove-TransportRule, and notes hidden rules may need MAPI-level tools |
| M1041 Encrypt Sensitive Information | All | Message encryption for sensitive content so a copied mailbox is less useful without keys |
| M1060 Out-of-Band Communications Channel | All | Verify payment and access changes by phone or another channel; run incident response off the corporate mail system |
External forwarding in Microsoft 365
Microsoft documents three outbound spam policy settings: Automatic (system-controlled, which since 2021 behaves as Off for new organisations and those not using forwarding, but may still behave as On elsewhere), On and Off. Off blocks inbox rule and mailbox forwarding to external addresses and returns NDR 5.7.520 to the sender; internal forwarding is unaffected. When controls conflict the block usually wins. Microsoft recommends setting On or Off explicitly. A common design is Off for the default policy, with a separate policy or remote domain settings for teams that genuinely need forwarding.
Application mail access
- Inventory app permissions: list every service principal with
Mail.Read,Mail.ReadWrite,Mail.Sendorfull_access_as_app, its owner and its last use. Remove dormant ones. See the Entra ID Applications and Consent Guide. - Scope with RBAC for Applications: Exchange Online RBAC for Applications grants an app access only to a defined set of mailboxes and replaces Application Access Policies. Microsoft warns that a tenant-wide
Mail.Readgrant in Entra ID still applies alongside a scoped grant, so remove the Entra grant, then confirm withTest-ServicePrincipalAuthorization. Changes can take 30 minutes to 2 hours to apply. - Restrict consent: block user consent to apps requesting mail scopes and route requests through admin review.
- Protect app credentials: alert on new secrets and certificates on existing apps and restrict who can add them. See the MITRE ATT&CK T1098 Account Manipulation Guide.
Rollout order
- Baseline: export all inbox rules with forwarding or redirect actions, mailbox forwarding settings, transport rules and the auto forwarded messages report; confirm
MailItemsAccessedis recorded for all users. - Clean up: remove unexplained external forwarding and rules, after contacting owners, and revoke dormant mail-reading apps.
- Pilot the block: set external forwarding to Off for a pilot group via a dedicated outbound policy, watch for 5.7.520 NDRs and add remote domain exceptions; roll back by moving the group to a policy set to On.
- Tenant-wide block: apply Off to the default policy and document the exception process.
- Scope apps: move mail-reading apps to RBAC for Applications scopes one at a time, testing each before removing the Entra grant.
- Deploy detections: start the rule, app read and sign-in correlation analytics in alert-only mode, tune for two to four weeks, then automate session revocation and rule removal for high-confidence hits.
Choosing where to start
Small organisations get most value from blocking external forwarding, enforcing MFA and enabling native alerts for suspicious rules. Large tenants with many integrations should prioritise the app inventory and RBAC scoping, because one over-privileged service principal exposes every mailbox. Google Workspace tenants need the equivalent controls: admin restrictions on automatic forwarding and review of third-party app access to Gmail scopes.
Where identity fits
T1114.002 is increasingly a non-human identity problem. The two incidents above both used application identities that read mail with no user and no MFA. Treat every app with mail scopes as a privileged identity: give it an owner, the narrowest mailbox scope, certificate credentials kept in a vault, short secret lifetimes, monitoring of credential changes and quarterly review. See the SaaS and OAuth App Governance Guide.
Lessons from incidents
- Test tenants count: Midnight Blizzard began with a test tenant account without MFA and a legacy app with production reach.
- Dormant apps keep their rights: Malwarebytes' abused service principal belonged to a product no longer in active use.
- Resetting the password is not recovery: forwarding and hiding rules, delegates and app consents must be reviewed on every compromised mailbox.
Framework mapping
| Framework | Relevant items |
|---|---|
| NIST SP 800-53 Rev. 5 | AC-6 Least Privilege; AC-4 Information Flow Enforcement; AU-2 Event Logging; AU-6 Audit Record Review, Analysis, and Reporting; SI-4 System Monitoring; SC-8 Transmission Confidentiality and Integrity |
| NIST CSF 2.0 | PR.AA-05 least-privilege permissions; PR.PS-04 log records generated; DE.CM-03 personnel activity and technology usage monitored |
| ISO/IEC 27001:2022 Annex A | 5.14 Information transfer; 5.15 Access control; 8.15 Logging; 8.16 Monitoring activities |
| CIS Controls v8.1 | Control 6 Access Control Management; Control 8 Audit Log Management; Control 9 Email and Web Browser Protections |
| Related ATT&CK | T1564.008 Email Hiding Rules; T1098.002 Additional Email Delegate Permissions; T1528 Steal Application Access Token; T1078.004 Cloud Accounts; T1534 Internal Spearphishing |
Practitioner checklist
- Set external automatic forwarding to Off explicitly and manage exceptions by remote domain or dedicated policy.
- Confirm
MailItemsAccessedis recorded for every mailbox and stream unified audit to the SIEM. - Alert on new inbox, forwarding and transport rules, especially after risky sign-ins or with finance and security keywords.
- Inventory apps with mail permissions, remove dormant ones and scope the rest with RBAC for Applications.
- Block user consent to mail scopes and alert on new credentials added to existing apps.
- Enforce phishing-resistant MFA and block legacy authentication in every tenant, including test tenants.
- Monitor endpoints for non-Outlook access to
.ostand.pstfiles. - Include rules, forwarding, delegates and app consents in every mailbox compromise recovery.
- Agree an out-of-band channel for incident response and payment verification.
Standards and references
- MITRE ATT&CK: Email Collection (T1114)
- MITRE ATT&CK: Email Forwarding Rule (T1114.003)
- Microsoft Learn: Use MailItemsAccessed to investigate compromised accounts
- Microsoft Learn: Control automatic external email forwarding in Microsoft 365
- Microsoft Learn: Role Based Access Control for Applications in Exchange Online
- Microsoft Learn: Audit log activities
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Business Email Compromise Response Playbook · ATT&CK Collection Tactic Guide · Entra ID Applications and Consent Guide · Microsoft 365 Security Guide