ATT&CK technique
View on MITRE ATT&CK →
T1114.001
Local Email Collection
Collection
11 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | O365 Email Receive and Hard Delete Takeover Behavior | production | 2026-09-23 |
| splunk | O365 Email Password and Payroll Compromise Behavior | production | 2026-09-23 |
| splunk | O365 Email Send and Hard Delete Exfiltration Behavior | production | 2026-09-23 |
| elastic | PowerShell Mailbox Collection Script | production | 2026-09-18 |
| elastic | Exchange Mailbox Export via PowerShell | production | 2026-09-18 |
| elastic | Suspicious Inter-Process Communication via Outlook | production | 2026-09-18 |
| elastic | Exporting Exchange Mailbox via PowerShell | production | 2026-09-18 |
| splunk | Email files written outside of the Outlook directory | production | 2026-09-08 |
| splunk | Mailsniper Invoke functions | production | 2026-05-13 |
| splunk | O365 Email Send and Hard Delete Suspicious Behavior | production | 2026-05-13 |
| sigma | Powershell Local Email Collection | test | 2022-12-25 |