T1114: T1114
Essential information
- MITRE technique ID
T1114- Confidence
- 100/100
- Revoked
- No
- Published
- 31/05/2017 23:31
- Modified
- 27/03/2026 01:08
- Author / Source
- The MITRE Corporation
Aliases
Email Collection
Platforms
windows macos linux Office Suite
Description
Kill chain phases
| Kill chain | Phase |
|---|---|
| mitre-attack | collection |
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.
Intrusion sets (APT) (59)
-
Storm-2755 usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
UNC5221 usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
ANTONIO EDUARDO FREDERICO relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
The MITRE Corporation Confidence 100
[APT28](https://attack.mitre.org/groups/G0007) is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub…
First seen 01/01/1970 · Last seen 16/11/5138 · -
APT42 relatedThe MITRE Corporation Confidence 100
[APT42](https://attack.mitre.org/groups/G1044) is an Iranian-sponsored threat group that conducts cyber espionage and surveillance.(Citation: Mandiant APT42-charms) The group primarily focuses on targets in the Middle East region, but has targeted…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Angry Likho relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Batavia relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Bloody Wolf relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
CloudWizard relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
CoralRaider relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
The MITRE Corporation Confidence 100
[APT29](https://attack.mitre.org/groups/G0016) is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).(Citation: White House Imposing Costs RU Gov April 2021)(Citation: UK Gov Malign RIS Activity April…
First seen 01/01/1970 · Last seen 16/11/5138 · -
CryptDesignBot relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
Malware (71)
-
BCB usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Zagrebator.RAT usesFamily
-
Family
-
Infamouse Chisel uses
-
CraxsRAT usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Rhadamanthys usesFamily
-
YTStealer usesFamily
-
AgentTesla usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
RagnarLocker usesFamily
-
RemKos RAT usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Ntospy uses
-
PixyNetLoader usesFamily
Reports (50)
-
20 MITREs 3 Malwares 7 Observables 1 APT
-
MAAS VIP_Keylogger Campaign related7 MITREs 1 Malware 5 Observables
-
17 MITREs 1 Malware 9 Observables 1 APT
-
15 MITREs 1 Malware 1 Observable
-
14 MITREs 1 Observable
-
14 MITREs 1 Malware 29 Observables
-
1 MITRE 1 Malware 1 APT
-
24 MITREs 3 Malwares 147 Observables 1 APT
-
1 CVE 20 MITREs 6 Malwares 20 Observables 1 APT
-
12 MITREs 1 Malware 12 Observables 1 APT
-
12 MITREs 1 Malware 12 Observables 1 APT
-
1 CVE 12 MITREs 1 Malware 2 Observables 1 APT
Vulnerabilities (CVE) (48)
Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges …
- Attack vector
- Network
- Published
- 12/04/2024
- Modified
- 21/12/2025
A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager …
- Attack vector
- Network
- Published
- 23/10/2024
- Modified
- 21/12/2025
Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute …
- Published
- 03/11/2021
- Modified
- 21/12/2025
Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a …
- Attack vector
- Local
- Published
- 03/11/2021
- Modified
- 27/05/2026
axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative …
- Attack vector
- NETWORK
- Published
- 07/03/2025
- Modified
- 10/04/2026
targets
Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern …
- Published
- 01/05/2023
- Modified
- 20/12/2025
Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the …
- Attack vector
- Network
- Published
- 04/09/2025
- Modified
- 21/12/2025
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily …
- Attack vector
- LOCAL
- Published
- 17/04/2024
- Modified
- 21/12/2025
targets
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
- Published
- 11/04/2022
- Modified
- 20/12/2025
RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim …
- Attack vector
- Network
- Published
- 09/06/2025
- Modified
- 21/12/2025
Course Of Action (3)
-
Multi-factor Authentication mitigates
-
Out-of-Band Communications Channel mitigates
-
Encrypt Sensitive Information mitigates