Local Email Collection
Local Email Collection [T1114.001]
Information
Introduction
Local Email Collection (T1114.001) is a sub-technique defined within the MITRE ATT&CK framework, categorized under the parent technique "Email Collection" (T1114). This sub-technique specifically addresses adversaries' actions to gather email data stored locally on compromised systems. Attackers typically seek to extract sensitive email communications, attachments, contact lists, and credentials stored locally in email clients or files. Collecting local email data enables adversaries to gain valuable intelligence, facilitate further attacks, or perform espionage activities.
Deep Dive Into Technique
Local Email Collection involves accessing and extracting email data stored on compromised endpoints. This data typically resides in local email client databases, files, or cached content. Attackers leverage various methods to achieve this:
Accessing Local Email Client Storage: Attackers target email client applications such as Microsoft Outlook, Mozilla Thunderbird, Apple Mail, or other local email software. These applications commonly store emails in proprietary or standard formats:
Outlook stores emails in PST (Personal Storage Table) or OST (Offline Storage Table) files.
Thunderbird uses MBOX format for email storage.
Apple Mail typically stores emails in EMLX files.
File System Search and Collection: Attackers may perform file system searches to locate email storage files based on known file extensions or file paths, such as:
.pst,.ost,.mbox,.emlx,.msg,.emlDefault email data storage paths (e.g.,
%USERPROFILE%\AppData\Local\Microsoft\Outlook\on Windows systems).
Credential Theft for Email Access: Attackers may first steal credentials or session tokens from compromised systems to access email data protected by authentication mechanisms.
Automated Tools and Scripts: Adversaries frequently use automated scripts or specialized tools to extract and exfiltrate email data quickly and efficiently. Common tools include:
PowerShell scripts designed to enumerate and copy email files.
Specialized malware or custom-built scripts targeting specific email clients.
Encryption and Exfiltration: Once collected, attackers frequently encrypt or compress email data before exfiltration to evade detection and reduce data transfer size.
When this Technique is Usually Used
Adversaries typically employ Local Email Collection in various attack scenarios and stages, including:
Reconnaissance and Espionage: Attackers collect sensitive communications, intellectual property, or confidential business information contained within emails.
Credential Harvesting and Account Takeover: Extracting locally stored emails may provide credentials or sensitive information needed for further lateral movement or account compromise.
Business Email Compromise (BEC) Attacks: Collecting email communications helps attackers impersonate legitimate users and facilitate fraudulent financial transactions or data theft.
Targeted Cyber Espionage Campaigns: Nation-state actors frequently leverage local email collection to gather intelligence from compromised systems, particularly targeting government, defense, or critical infrastructure organizations.
Post-Exploitation Stage: Typically occurs after initial access and privilege escalation, once attackers have sufficient permissions to access sensitive local email data.
How this Technique is Usually Detected
Detection of Local Email Collection requires monitoring and analyzing system behaviors, file access patterns, and network activities. Effective detection strategies include:
File System Monitoring and Auditing:
Track file access events involving email storage files (e.g., PST, OST, MBOX).
Monitor unusual file copy or read operations involving email storage paths.
Endpoint Detection and Response (EDR) Tools:
Detect anomalous processes or scripts attempting to access or copy email data.
Identify suspicious PowerShell or scripting activities interacting with email client data.
User Behavior Analytics (UBA):
Detect abnormal user or account behavior, such as accessing large amounts of email data or sudden file transfers.
Network Monitoring and Data Loss Prevention (DLP):
Identify unusual data exfiltration attempts, particularly involving email file formats or compressed archives.
Alert on large outbound transfers of email-related files or encrypted archives.
Specific Indicators of Compromise (IoCs):
Unusual access timestamps or file modification events on email storage files.
Suspicious scripts or binaries residing in temporary directories targeting email data.
Unrecognized encrypted or compressed archives containing email files found on endpoints.
Why it is Important to Detect This Technique
Detecting Local Email Collection is critical due to the severe impacts and risks associated with unauthorized email data extraction:
Sensitive Information Exposure: Emails frequently contain sensitive business information, personal data, intellectual property, and confidential communications. Unauthorized access can lead to severe data breaches and compliance violations.
Credential Compromise: Attackers may extract credentials or authentication tokens stored in emails, enabling further lateral movement, privilege escalation, or account takeovers.
Reputational Damage: Exposure of sensitive email communications can severely damage organizational reputation, customer trust, and business relationships.
Financial Losses: Local email collection is often a precursor to financial fraud, including Business Email Compromise (BEC) attacks, invoice manipulation, or fraudulent financial transactions.
Operational Disruption: Email data compromise can lead to disruption of internal communications, business operations, and critical decision-making processes.
Early Detection Advantage: Promptly detecting email collection activities allows organizations to contain breaches early, minimize damage, and prevent further attacker actions.
Examples
Real-world examples illustrating Local Email Collection attacks include:
APT28 (Fancy Bear, Sofacy):
Russian state-sponsored threat actor known to target email client data in espionage campaigns.
Leveraged specialized malware and scripts to extract PST files from victim systems, enabling intelligence gathering and espionage.
APT29 (Cozy Bear):
Conducted targeted intrusions against government and diplomatic organizations.
Collected local email data from compromised endpoints, facilitating intelligence collection and enabling further attacks.
FIN7 Cybercrime Group:
Financially motivated actor targeting businesses across multiple sectors.
Utilized PowerShell scripts to identify, collect, and exfiltrate PST files from compromised systems, aiding in credential harvesting and financial fraud schemes.
Operation Aurora (Google Hack, 2009-2010):
Sophisticated cyber espionage campaign targeting numerous technology companies, including Google.
Attackers accessed and extracted sensitive email content stored locally, leading to significant data breaches and intellectual property theft.
TrickBot Malware:
Banking Trojan and modular malware frequently used to harvest email data from compromised endpoints.
TrickBot modules specifically targeted local Outlook email files (PST/OST) to extract sensitive financial and personal information for fraudulent activities.
These examples highlight the frequent usage of Local Email Collection across diverse threat actor groups, attack motivations, and sectors, emphasizing the critical need for robust detection and mitigation strategies.
Last updated
Was this helpful?