Account Discovery: Email Account (T1087.003)

Tactic: Discovery · Platforms: Windows, Office Suite

The interactive view maps 1 detection strategy, 4 threat groups, 8 software entries, 2 campaigns to this technique, alongside D3FEND countermeasures and data-component coverage.

Sub-technique of Account Discovery (T1087).

Overview

Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).

In on-premises Exchange and Exchange Online, the Get-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.

In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.

Explore

• Open T1087.003 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1087.003
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan