Remote Email Collection
Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches fo...
BY SOURCE
PROCEDURES (15)
Auto-extracted: 2 detections for phish
Auto-extracted: 2 detections for powershell
Auto-extracted: 2 detections for exfiltrat
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for token
Auto-extracted: 1 detections for office
Auto-extracted: 1 detections for office
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for oauth
Auto-extracted: 1 detections for script block
Auto-extracted: 1 detections for script block
Auto-extracted: 1 detections for token