Which SIEM platforms have a T1114 detection rule?

df00tech provides T1114 (Email Collection) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Email Collection (T1114)?

Detecting Email Collection requires the following data sources: File: File Access, Application Log: Application Log Content, Microsoft Defender for Endpoint, Microsoft 365 Unified Audit Log.

What severity and confidence is the T1114 detection?

The T1114 detection is rated high severity with medium confidence.

What are common false positives for T1114?

Common false positives for T1114 include: Enterprise backup software (Veeam Agent, Backup Exec, Windows Server Backup) accessing PST/OST files during scheduled backup windows — exclude by known backup service account and initiating process path; Email migration tools (MigrationWiz, BitTitan, native PST import via New-MailboxImportRequest) performing authorized mailbox migrations — coordinate with IT to exclude migration service accounts during migration windows; Anti-virus and EDR scanning engines (MsMpEng.exe, SentinelAgent.exe) reading email files during on-demand or scheduled scans — already excluded by LegitEmailClients list, extend as needed.

T1114 IBM QRadar · QRadar

Detect Email Collection in IBM QRadar

Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients. Sub-techniques cover local email file access (T1114.001), remote server collection via EWS/IMAP (T1114.002), and persistent inbox forwarding rules (T1114.003). Threat actors including Ember Bear, Silent Librarian, Magic Hound, Scattered Spider, and Emotet have all leveraged email collection as a high-value intelligence gathering technique.

MITRE ATT&CK

Tactic: Collection
Technique: T1114 Email Collection
Canonical reference: https://attack.mitre.org/techniques/T1114/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  sourceip,
  username,
  "filename" AS TargetFile,
  "Image" AS ProcessImage,
  "CommandLine" AS CommandLine,
  CATEGORYNAME(category) AS EventCategory,
  LOGSOURCETYPENAME(logsourceid) AS LogSourceType
FROM events
WHERE
  LOGSOURCETYPENAME(logsourceid) ILIKE '%Sysmon%'
  AND QIDNAME(qid) ILIKE '%File Create%'
  AND (
    "filename" ILIKE '%.pst'
    OR "filename" ILIKE '%.ost'
    OR "filename" ILIKE '%.mbox'
    OR "filename" ILIKE '%.eml'
    OR "filename" ILIKE '%.msg'
    OR "filename" ILIKE '%.dbx'
    OR "filename" ILIKE '%.nsf'
  )
  AND "Image" NOT ILIKE '%\\outlook.exe'
  AND "Image" NOT ILIKE '%\\OUTLOOK.EXE'
  AND "Image" NOT ILIKE '%\\thunderbird.exe'
  AND "Image" NOT ILIKE '%\\SearchIndexer.exe'
  AND "Image" NOT ILIKE '%\\SearchProtocolHost.exe'
  AND "Image" NOT ILIKE '%\\MsMpEng.exe'
  AND "Image" NOT ILIKE '%\\MsSense.exe'
  AND (
    "Image" ILIKE '%\\powershell.exe'
    OR "Image" ILIKE '%\\pwsh.exe'
    OR "Image" ILIKE '%\\cmd.exe'
    OR "Image" ILIKE '%\\python.exe'
    OR "Image" ILIKE '%\\python3.exe'
    OR "Image" ILIKE '%\\wscript.exe'
    OR "Image" ILIKE '%\\cscript.exe'
    OR "Image" ILIKE '%\\mshta.exe'
    OR "Image" ILIKE '%\\robocopy.exe'
    OR "Image" ILIKE '%\\xcopy.exe'
    OR "Image" ILIKE '%\\7z.exe'
    OR "Image" ILIKE '%\\winrar.exe'
    OR "Image" ILIKE '%\\rar.exe'
    OR "Image" ILIKE '%\\curl.exe'
    OR "Image" ILIKE '%\\wget.exe'
    OR "filename" ILIKE '%AppData%Outlook%'
    OR "filename" ILIKE '%AppData%Thunderbird%'
    OR "filename" ILIKE '%AppData%Windows Mail%'
  )
  AND LOGSOURCETYPENAME(logsourceid) NOT ILIKE '%Flow%'
LAST 24 HOURS
ORDER BY starttime DESC

high severity medium confidence

QRadar AQL query detecting Sysmon file creation events (EventID 11) where suspicious processes access local email data stores. Excludes known legitimate email client and indexer processes. Targets PowerShell, Python, scripting engines, archival tools, and copy utilities touching PST/OST/MBOX/EML/MSG/DBX/NSF files in Outlook or Thunderbird profile directories.

Data Sources

QRadar Sysmon log sourceMicrosoft Windows Sysmon DSM

Required Tables

events

False Positives & Tuning

Enterprise backup agents (Commvault, NetBackup, Veeam) accessing PST files as part of scheduled mailbox backup jobs
Legal eDiscovery tools using command-line interfaces to collect email archives for compliance or litigation holds
IT migration scripts during Office 365 onboarding that copy local PST files to upload to Exchange Online

Download portable Sigma rule (.yml)

Other platforms for T1114

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Copy Outlook PST/OST Files via PowerShell to Staging Directory
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-ChildItem', 'Outlook', 'Copy-Item'. Sysmon Event ID 11: File creation events in %TEMP%\email_staging for each OST/PST copied. DeviceFileEvents (MDE): FileCopied action for .ost/.pst files with InitiatingProcessFileName=powershell.exe. DeviceProcessEvents: PowerShell process with command line referencing Outlook and Copy-Item.
Test 2Enumerate Outlook Inbox via COM Object (MAPI)
Expected signal: Sysmon Event ID 1: PowerShell process with CommandLine containing 'Outlook.Application', 'MAPI', 'GetDefaultFolder'. Sysmon Event ID 7 (ImageLoad): Outlook interop DLLs (olmapi32.dll, MSPST32.dll) loaded into powershell.exe process. Sysmon Event ID 11: CSV file created at %TEMP%\email_harvest.csv. DeviceImageLoadEvents (MDE): non-Outlook process loading Outlook MAPI libraries.
Test 3Remote Exchange Mailbox Enumeration via EWS SOAP Request
Expected signal: Sysmon Event ID 3: Network connection from powershell.exe to outlook.office365.com (40.99.x.x range) on destination port 443. DeviceNetworkEvents (MDE): OutboundConnectionAttempt or ConnectionSuccess from powershell.exe to Microsoft O365 EWS IP. PowerShell ScriptBlock Log (Event ID 4104): full SOAP request body including 'FindItem', 'inbox', 'EWS' strings. O365 Unified Audit Log: failed or successful MailItemsAccessed operation depending on authentication outcome.
Test 4Create Malicious Inbox Forwarding Rule via Exchange Online PowerShell
Expected signal: Sysmon Event ID 1: PowerShell process with CommandLine containing 'New-InboxRule', 'ForwardTo', and target email address. PowerShell ScriptBlock Log (Event ID 4104): full script with New-InboxRule command and ForwardTo parameter value. O365 Unified Audit Log (if connection succeeds): New-InboxRule operation with Parameters showing [email protected]. Sysmon Event ID 3: PowerShell connecting to O365 PowerShell endpoint (*.outlook.com port 443).

Last updated: 2026-04-18 Research depth: deep

References (9)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1114 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Email Collection in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1114

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Sub-techniques (3)

Related Techniques

Same Tactic: Collection

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1114

Testing Methodology

Unlock Pro Content

Related Detections

Sub-techniques (3)

Related Techniques

Same Tactic: Collection

Popular Detections

Get new detections in your inbox