Esc
Local Email Collection - T1114.001

(ATT&CK® Technique)
Definition

Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files.
D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.
        graph LR;

     T1114001["Local Email Collection"] --> |reads| Email["Email"]; class T1114001 OffensiveTechniqueNode;
        class Email ArtifactNode; click Email href "/dao/artifact/d3f:Email";
        click T1114001 href "/offensive-technique/attack/T1114.001/"; click Email href "/dao/artifact/d3f:Email";        T1114001["Local Email Collection"] --> |accesses| Resource["Resource"]; class T1114001 OffensiveTechniqueNode;
        class Resource ArtifactNode; click Resource href "/dao/artifact/d3f:Resource";
        click T1114001 href "/offensive-technique/attack/T1114.001/"; click Resource href "/dao/artifact/d3f:Resource";      EmulatedFileAnalysis["Emulated File Analysis"] -->
          | analyzes | Email["Email"];

          EmulatedFileAnalysis["Emulated File Analysis"] -.->
            | may-detect | T1114001["Local Email Collection"] ;
          class EmulatedFileAnalysis DefensiveTechniqueNode;
          class Email ArtifactNode;
          click EmulatedFileAnalysis href "/technique/d3f:EmulatedFileAnalysis"; DynamicAnalysis["Dynamic Analysis"] -->
          | analyzes | Email["Email"];

          DynamicAnalysis["Dynamic Analysis"] -.->
            | may-detect | T1114001["Local Email Collection"] ;
          class DynamicAnalysis DefensiveTechniqueNode;
          class Email ArtifactNode;
          click DynamicAnalysis href "/technique/d3f:DynamicAnalysis"; HomoglyphDetection["Homoglyph Detection"] -->
          | analyzes | Email["Email"];

          HomoglyphDetection["Homoglyph Detection"] -.->
            | may-detect | T1114001["Local Email Collection"] ;
          class HomoglyphDetection DefensiveTechniqueNode;
          class Email ArtifactNode;
          click HomoglyphDetection href "/technique/d3f:HomoglyphDetection";                                        DecoyFile["Decoy File"] -->
          | spoofs | Email["Email"];

          DecoyFile["Decoy File"] -.->
            | may-deceive | T1114001["Local Email Collection"] ;
          class DecoyFile DefensiveTechniqueNode;
          class Email ArtifactNode;
          click DecoyFile href "/technique/d3f:DecoyFile";              SenderMTAReputationAnalysis["Sender MTA Reputation Analysis"] -->
          | analyzes | Email["Email"];

          SenderMTAReputationAnalysis["Sender MTA Reputation Analysis"] -.->
            | may-detect | T1114001["Local Email Collection"] ;
          class SenderMTAReputationAnalysis DefensiveTechniqueNode;
          class Email ArtifactNode;
          click SenderMTAReputationAnalysis href "/technique/d3f:SenderMTAReputationAnalysis"; SenderReputationAnalysis["Sender Reputation Analysis"] -->
          | analyzes | Email["Email"];

          SenderReputationAnalysis["Sender Reputation Analysis"] -.->
            | may-detect | T1114001["Local Email Collection"] ;
          class SenderReputationAnalysis DefensiveTechniqueNode;
          class Email ArtifactNode;
          click SenderReputationAnalysis href "/technique/d3f:SenderReputationAnalysis";                                 LocalFilePermissions["Local File Permissions"] -->
          | restricts | Email["Email"];

          LocalFilePermissions["Local File Permissions"] -.->
            | may-isolate | T1114001["Local Email Collection"] ;
          class LocalFilePermissions DefensiveTechniqueNode;
          class Email ArtifactNode;
          click LocalFilePermissions href "/technique/d3f:LocalFilePermissions";                      FileIntegrityMonitoring["File Integrity Monitoring"] -->
          | analyzes | Email["Email"];

          FileIntegrityMonitoring["File Integrity Monitoring"] -.->
            | may-detect | T1114001["Local Email Collection"] ;
          class FileIntegrityMonitoring DefensiveTechniqueNode;
          class Email ArtifactNode;
          click FileIntegrityMonitoring href "/technique/d3f:FileIntegrityMonitoring";              RestoreFile["Restore File"] -->
          | restores | Email["Email"];

          RestoreFile["Restore File"] -.->
            | may-restore | T1114001["Local Email Collection"] ;
          class RestoreFile DefensiveTechniqueNode;
          class Email ArtifactNode;
          click RestoreFile href "/technique/d3f:RestoreFile";              FileEviction["File Eviction"] -->
          | deletes | Email["Email"];

          FileEviction["File Eviction"] -.->
            | may-evict | T1114001["Local Email Collection"] ;
          class FileEviction DefensiveTechniqueNode;
          class Email ArtifactNode;
          click FileEviction href "/technique/d3f:FileEviction";              FileAnalysis["File Analysis"] -->
          | analyzes | Email["Email"];

          FileAnalysis["File Analysis"] -.->
            | may-detect | T1114001["Local Email Collection"] ;
          class FileAnalysis DefensiveTechniqueNode;
          class Email ArtifactNode;
          click FileAnalysis href "/technique/d3f:FileAnalysis"; RemoteFileAccessMediation["Remote File Access Mediation"] -->
          | isolates | Email["Email"];

          RemoteFileAccessMediation["Remote File Access Mediation"] -.->
            | may-isolate | T1114001["Local Email Collection"] ;
          class RemoteFileAccessMediation DefensiveTechniqueNode;
          class Email ArtifactNode;
          click RemoteFileAccessMediation href "/technique/d3f:RemoteFileAccessMediation";                           FileEncryption["File Encryption"] -->
          | encrypts | Email["Email"];

          FileEncryption["File Encryption"] -.->
            | may-harden | T1114001["Local Email Collection"] ;
          class FileEncryption DefensiveTechniqueNode;
          class Email ArtifactNode;
          click FileEncryption href "/technique/d3f:FileEncryption";              EmailFiltering["Email Filtering"] -->
          | filters | Email["Email"];

          EmailFiltering["Email Filtering"] -.->
            | may-isolate | T1114001["Local Email Collection"] ;
          class EmailFiltering DefensiveTechniqueNode;
          class Email ArtifactNode;
          click EmailFiltering href "/technique/d3f:EmailFiltering"; RestoreEmail["Restore Email"] -->
          | restores | Email["Email"];

          RestoreEmail["Restore Email"] -.->
            | may-restore | T1114001["Local Email Collection"] ;
          class RestoreEmail DefensiveTechniqueNode;
          class Email ArtifactNode;
          click RestoreEmail href "/technique/d3f:RestoreEmail";                       EmailRemoval["Email Removal"] -->
          | deletes | Email["Email"];

          EmailRemoval["Email Removal"] -.->
            | may-evict | T1114001["Local Email Collection"] ;
          class EmailRemoval DefensiveTechniqueNode;
          class Email ArtifactNode;
          click EmailRemoval href "/technique/d3f:EmailRemoval";
json