T1114.001: Email Collection: Local Email Collection
T1114.001 (Email Collection: Local Email Collection) is classified under the Collection tactic within the MITRE ATT&CK framework. Adversary tradecraft focused on gathering sensitive files, keystrokes, screen captures, audio, and database records prior to exfiltration. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 15 distinct malware families, totaling over 513 validated samples.
Technical Anatomy & Adversary Tradecraft
Adversaries leverage Email Collection: Local Email Collection to accomplish operational objectives while minimizing anomalous forensic footprints. When executing Email Collection: Local Email Collection, malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.
In modern multi-stage campaigns, T1114.001 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute Email Collection: Local Email Collection to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.
https://attack.mitre.org/techniques/T1114/001/.
Detection Engineering & Threat Hunting
Detecting Email Collection: Local Email Collection requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:
- Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
- API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
- Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.
SOC Containment & Hardening Guidance
To mitigate risks associated with T1114.001 (Email Collection: Local Email Collection) across production infrastructure, security teams should implement the following defensive controls:
- Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
- Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
- Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing Email Collection: Local Email Collection across adjacent network segments.
Cataloged Malware Families Utilizing T1114.001 (15 Families)
The following malware families in the SystemHelpDesk catalog have been verified utilizing T1114.001 (Email Collection: Local Email Collection):
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| netsky | Worm | 105 | Worm:Win32/Netsky is a historically monumental, prolific mass-mailing computer worm that emerged in February 2004, causing tens of millions of dollars in global... |
| chir | Worm | 99 | Chir (extensively documented as Virus:Win32/Chir.B@mm, W32.Chir, and Runouce) is a historic, highly aggressive mass-mailing worm and polymorphic file infector f... |
| mydoom | Worm | 88 | Mydoom (cataloged historically under designations including Worm:Win32/Mydoom, W32.Mydoom@mm, W32.Novarg.A@mm, and Shimgapi) is one of the most prolific and fas... |
| brontok | Worm | 57 | Brontok (widely recognized across cybersecurity history as Rontokbr, Worm:Win32/Brontok, and W32.Rontokbro@mm) is a landmark, highly disruptive mass-mailing com... |
| warezov | Worm | 55 | Warezov (also widely tracked in security industry literature as Stration, Email-Worm.Win32.Warezov, and Worm:Win32/Warezov) is a landmark mass-mailing email wor... |
| kelihos | Spam Bot | 47 | Worm:Win32/Kelihos (also known as Hlux) was a massive, highly resilient peer-to-peer (P2P) botnet that operated from 2010 until its final federal dismantling in... |
| cardspy | Infostealer | 44 | CardSpy is a specialized payment card and financial surveillance trojan active since 2013. Distributed through phishing emails, trojanized e-commerce utilities,... |
| winevar | Trojan | 5 | Virus:Win32/Winevar is a classic, destructive file infector and mass-mailing worm. Unlike modern stealthy trojans, Winevar is 'noisy' and aggressive, designed t... |
| zafi | Advanced Threat | 5 | Worm:Win32/Zafi is a classic, historically significant mass-mailing computer worm that caused widespread disruption in the mid-2000s. Zafi (particularly variant... |
| kbot | Ransomware | 2 | Trojan:Win32/Kbot is an advanced, modular botnet agent and banking trojan that shares code similarities and operational tactics with high-tier threats like Emot... |
| rustock | Advanced Threat | 2 | Rootkit:Win32/Rustock (internally designated as Costrat) was an extraordinarily sophisticated, stealthy kernel-mode rootkit and spam botnet active between 2006 ... |
| mailspy | Trojan | 1 | <h3>Executive Summary</h3> MailSpy (often detected as Spyware.MailSpy or Riskware.EmailMonitor) is a specialized surveillance utility designed to covertly inter... |
| smsspy | Trojan | 1 | TrojanSpy:AndroidOS/Smsspy (or Win32 variants targeting mobile emulators/connected devices) is a specialized spyware focused entirely on intercepting and exfilt... |
| spectorpro | Advanced Threat | 1 | Spyware:Win32/Spectorpro (or Spector Pro) is commercial employee monitoring and surveillance software that is frequently classified as spyware/riskware. While i... |
| vidar | Infostealer | 1 | Trojan:Win32/Vidar (commercially marketed as Vidar Stealer) is a prolific, commercially available information-stealing trojan first observed on underground Russ... |