| ID | Name |
|---|---|
| T1087.001 | Local Account |
| T1087.002 | Domain Account |
| T1087.003 | Email Account |
| T1087.004 | Cloud Account |
Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).[1]
In on-premises Exchange and Exchange Online, the Get-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.[2][3]
In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.[4]
| ID | Name | Description |
|---|---|---|
| S0093 | Backdoor.Oldrea |
Backdoor.Oldrea collects address book information from Outlook.[5] |
| S0635 | BoomBox |
BoomBox can execute an LDAP query to discover e-mail accounts for domain users.[6] |
| C0027 | C0027 |
During C0027, Scattered Spider accessed Azure AD to identify email addresses.[7] |
| S0367 | Emotet |
Emotet has been observed leveraging a module that can scrape email addresses from Outlook.[8][9][10] |
| S0531 | Grandoreiro |
Grandoreiro can parse Outlook .pst files to extract e-mail addresses.[11] |
| C0038 | HomeLand Justice |
During HomeLand Justice, threat actors used compromised Exchange accounts to search mailboxes for administrator accounts.[12] |
| S0681 | Lizar |
Lizar can collect email accounts from Microsoft Outlook and Mozilla Thunderbird.[13] |
| G0059 | Magic Hound |
Magic Hound has used Powershell to discover email accounts.[14] |
| S0413 | MailSniper |
MailSniper can be used to obtain account names from Exchange and Office 365 using the |
| G1039 | RedCurl |
RedCurl has collected information about email accounts.[15][16] |
| S0358 | Ruler |
Ruler can be used to enumerate Exchange users and dump the GAL.[17] |
| G0034 | Sandworm Team |
Sandworm Team used malware to enumerate email settings, including usernames and passwords, from the M.E.Doc application.[18] |
| G0092 | TA505 |
TA505 has used the tool EmailStealer to steal and send lists of e-mail addresses to a remote server.[19] |
| S0266 | TrickBot |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0229 | Enumeration of Global Address Lists via Email Account Discovery | AN0641 |
Enumeration of global address lists or email account metadata via PowerShell cmdlets (e.g., Get-GlobalAddressList) or MAPI/RPC from non-admin, non-mailserver systems. |
| AN0642 |
Suspicious querying of organization-wide directory data via Google Workspace Directory API or Outlook GAL sync in high volume from abnormal users, service accounts, or unknown device contexts. |