Techniques › T1114.002 › AN0131
AN0131 Analytic 0131
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects adversaries accessing remote mail systems (e.g., Exchange Online, O365) using stolen credentials or OAuth tokens, followed by scripted access to mailbox contents via PowerShell, AADInternals, or unattended API queries. Detection focuses on abnormal logon sessions, user agents, IP locations, and scripted or tool-based email data access.</p>
- Detects
- T1114.002 Remote Email Collection
- Part of
- DET0048 Detect Remote Email Collection via Abnormal Login and Programmatic Access
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| azure:signinlogs | Abnormal sign-in from scripting tools (PowerShell, AADInternals) | DC0067 Logon Session Creation |
| m365:purview | MailItemsAccessed & Exchange Audit | DC0038 Application Log Content |
| WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 | DC0064 Command Execution |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
UserAgentPattern | Filters user agents like 'PowerShell', 'AADInternals', 'python-requests' which can vary depending on script/tool. |
TimeWindow | Defines the temporal correlation window between login, command execution, and outbound email access. |
KnownIPLocations | Defines baseline geo/IP address ranges to suppress known corporate access. |
PrivilegedUserList | Defines the accounts considered privileged (admin, execs) and worthy of tighter thresholds. |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2012-0767 | Adobe Flash Player | Mapped |