Forensia CTI Core

About

Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients.

Platforms: Windows, macOS, Linux, Office SuiteMITRE ATT&CK ↗

Used by actors

4 known groups

G0059 Magic Hound G0122 Silent Librarian G1003 Ember Bear G1015 Scattered Spider

Software

2 malware/tools implement this

EmotetTRANSLATEXT

Corpus indicators tagged with this technique

469 indicators in the corpus carry T1114.

Indicator	Type	Family	Sev	Src
0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb	sha256	—	80	1
ec7b0bc82c00464d8e0a59bc19c585e2	hash	phishing	80	1
aa7ea19e34567458b4ee66a7cd274181764984bf32123f756a7fdc64d5857b31	hash	—	80	3
7fda5f10a2bc212daaa467484c56eb8abf3f3681f6405c5c2fac16d4124e44ca	hash	phishing	80	3
7ea0930a332788c2e88e5822e4908d77cdcaad57e0e97401ed8fe4b117fdfc95	sha256	—	80	1
5d2ad1795b0dfc4a58424b2fa2f002246f653b119d362954ae270b6998e9d575	hash	phishing	80	3
7f30259d72eb7432b2454c07be83365ecfa835188185b35b30d11654aadf86a0	sha256	phishing	80	3
f06e7e1a4363a01ba2a4fee2e28abdd623abf4194bda373f23ff0e151b5c2b45	hash	—	80	3
291cb1fd0f2709b4457447cbb87adacf5c36c1bcb0f8754524024d44174bb195	hash	—	80	3
1f00fd604bb18bbe3081f9ce8d741c4029d2a2125eb8888ac4e0d955938059d6	hash	—	80	3
c5ec55270af084d3c07d2918098d598bc2c5ca42f4189d69cdfcae2c958e5ec7	hash	phishing	80	3
71fa6a00314701fef5c6f32c17e1438063d05616198ac9a12004aeab957e11ae	sha256	—	80	1
9fb6f4c55e5198739123264f8007cf6e22b3821af97a00a471bd54b30991ecd0	sha256	—	80	1
1fd8ba64a687247466fa6e8b7d194154439ef527746fdb8c18b3c3d65b6d2390	sha256	—	80	1
375c2c84e2ca022c565507523b75c9c08a455479861ea41fc9b9ff74b3453445	hash	phishing	80	3
95fc58dc321b07ecc99d95359bcdee08a5beb519ead8e70e40f33928533a1b14	hash	phishing	80	3
3b7642b0f84e83a36334c608655c6cb7aae774839a6a3488526b853d89830a60	hash	—	80	3
c79091ceae7cd592fc08e4854cda7c1182af762b6b126371cc604debdc995fc7	hash	—	80	3
ebcf977806f68af3147e0b78b55f6aed	hash	—	80	2
13ac78f8f2ed76a03c85f0cdef07e5463aa64458303c0949090fcd81868ba8ca	hash	phishing	80	3
0378a5ef51b008aa2d6b76bd44a0bf061339bc3b737a188ec82029444d4d18fe	hash	—	80	3
cc19e502e4201cc974c753b96429027925224f53	hash	—	80	2
6c428acbd91be85fedf9cbb334457ddea08ff624d4de88041749578e968d62a8	hash	phishing	80	3
6a4cb1c75e1c59bbd4fbc4667f4c3bb5a74fe965	sha1	phishing	78	3
eb8ede7598220dbef28953dc7df2e5418d52fa36	sha1	phishing	78	3
ea5d2096a2ef3dfe4fb870bd1f0270efaea993a6	sha1	phishing	78	3
e9a44b3fe951cca57313533d6bc1d11e789c2018	sha1	phishing	78	3
cf3cbf93adf43d50618c88705857d3adb123ed24	sha1	phishing	78	3
2ea61cdead470f570586f513e22d43d787befec6	sha1	phishing	78	3
f496736e2d2344de7963d4f722381f03227ec452	sha1	phishing	78	3

Showing the top 30 by severity of 469.