aol.pm

Local Email Collection

Subtechnique · ATTACK:enterprise:T1114.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1114.001",
  "title": "Local Email Collection",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1114/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--1e9eb839-294b-48cc-b0d3-c45555a2a004",
  "external_id": "T1114.001",
  "domain": "enterprise",
  "created": "2020-02-19T18:46:06.098Z",
  "modified": "2026-05-12T15:12:00.622Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "Microsoft Outlook Files",
      "url": "https://support.office.com/en-us/article/introduction-to-outlook-data-files-pst-and-ost-222eaf92-a995-45d9-bde2-f331f60e2790"
    },
    {
      "source_name": "Outlook File Sizes",
      "url": "https://practical365.com/clients/office-365-proplus/outlook-cached-mode-ost-file-sizes/"
    }
  ]
}

Explicit source assertions (24)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1142 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02fad9c6-12fb-46d0-b307-877e9c80f4d0

ESET Turla Lunar toolset May 2024

ATTACK:enterprise:G0090 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--167a6f5e-e1e0-4a65-a64e-0696f085a68c

Palo Alto Ashen Lepus DEC 2025

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c54cdd2-576a-4ba5-9cf2-33bda233e018

group-ib_redcurl1

ATTACK:enterprise:M1060 → mitigates → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21ad0084-2f19-4559-9de1-dc06d1809ef0

TrustedSec OOB Communications

ATTACK:enterprise:S0226 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25d65c10-5fa3-40c1-9e25-936894446178

Talos Smoke Loader July 2018

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d8e97f7-9c58-47e1-b2c9-2cc55cca974f

Kaspersky QakBot September 2021 · Kroll Qakbot June 2020 · Trend Micro Qakbot December 2020

ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44321d5a-7717-4c7b-8e3d-8f6db5239179

Hunt Sea Turtle 2024

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c736aad-9847-4059-9d1e-dc2f551952d0

GitHub Pupy

ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64e3196b-50c6-47d9-8841-1b7902a1546a

FireEye CARBANAK June 2017

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--757bed64-558b-4ea7-84b9-b82d8b23f9b2

Mandiant APT1

ATTACK:enterprise:S0115 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--892ff1d1-3da9-489e-89c3-374ab07a417b

Proofpoint Operation Transparent Tribe March 2016

ATTACK:enterprise:C0002 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90839ffa-293e-4fe3-98d2-e8edfd55be2c

McAfee Night Dragon

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c98640e-0307-48bb-aafc-af14a774fd5b

Github PowerShell Empire

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8730dc5-9f3b-449d-8b17-f5a6638aaac4

NCC Group Chimera January 2021

ATTACK:enterprise:S0526 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac772e5c-ef7b-433a-bc12-4125635699b1

Cybereason Kimsuky November 2020

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b6336d7c-e869-4491-9e8a-5ea5847a58ae

FireEye APT35 2018

ATTACK:enterprise:S0050 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bcb8ac03-4f58-4cd8-af58-c3df991c8af5

F-Secure Cosmicduke

ATTACK:enterprise:S0594 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c69d17b1-c261-44c6-9da5-c310cf20f91b

Trend Micro Muddy Water March 2021

ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e29acb85-fcd0-4286-b4bb-7ac2c8d72a5b

ESET MirrorFace DEC 2022

ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2ae5489-3473-48d6-ba26-f5a8391ad106

ESET WinterVivern 2023

ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e756554a-3da8-4dd0-a4ec-1f33bc8c4df7

Mandiant_UNC1549TTPsTools_Nov2025

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ea023f09-6a7d-445c-a39d-5e57eea2706b

CIS Emotet Dec 2018

ATTACK:enterprise:T1114.001 → subtechnique-of → ATTACK:enterprise:T1114

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f4c8b1b6-8204-4cbd-be5b-f3a6080726e7

ATTACK:enterprise:M1041 → mitigates → ATTACK:enterprise:T1114.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f5d32cc0-dc9e-4ff4-8af2-b131c303a1a1

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.