What MITRE ATT&CK T1114.003: Email Forwarding Rule (Enterprise Tactic TA0009 - Collection) requires
MITRE ATT&CK T1114.003 (Email Forwarding Rule) is an Enterprise Collection sub-technique of T1114 (Email Collection). Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim's organization to use as part of further exploits or operations. Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators. Affected platforms: Windows, macOS, Linux, Office Suite. MITRE-documented mitigations include M1042 Disable or Remove Feature or Program, M1041 Encrypt Sensitive Information, M1047 Audit, M1060 Out-of-Band Communications Channel. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-03, AC-04, AC-16, AC-17, AC-19, AC-20, CM-02, CM-06.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1114/003/
SHA-256 integrity: 9c8f5c7be2c994bbf2ed3f51923d1c1a212fda5f74bb7693723ffe0b981f95a1
Primary Citations — 7 traced to source
- MITRE ATT&CK Technique T1114.003: Email Forwarding Rule (https://attack.mitre.org/techniques/T1114/003/)
- MITRE ATT&CK Tactic TA0009: Collection (https://attack.mitre.org/tactics/TA0009/)
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/mitre-attack-t1114-003-email-forwarding-rule.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/mitre-attack-t1114-003-email-forwarding-rule.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/mitre-attack-t1114-003-email-forwarding-rule
- Back to registry: Browse all 10,085 compliance nodes