Sub-technique of T1087 Account Discovery.View on attack.mitre.org
Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).
In on-premises Exchange and Exchange Online, the Get-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.
In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.
Rules on DetectionCode tagged with T1087.003.
| Used by | Procedure example |
|---|---|
| GroupMagic Hound | Magic Hound has used Powershell to discover email accounts. |
| GroupRedCurl | RedCurl has collected information about email accounts. |
| GroupSandworm Team | Sandworm Team used malware to enumerate email settings, including usernames and passwords, from the M.E.Doc application. |
| GroupTA505 | TA505 has used the tool EmailStealer to steal and send lists of e-mail addresses to a remote server. |
| Used by | Procedure example |
|---|---|
| MalwareBackdoor.Oldrea | Backdoor.Oldrea collects address book information from Outlook. |
| MalwareBoomBox | BoomBox can execute an LDAP query to discover e-mail accounts for domain users. |
| MalwareEmotet | Emotet has been observed leveraging a module that can scrape email addresses from Outlook. |
| MalwareGrandoreiro | Grandoreiro can parse Outlook .pst files to extract e-mail addresses. |
| MalwareKali365 | Kali365 has leveraged an Exchange Admin module that utilizes Graph to enumerate mailboxes in victim environments. |
| MalwareLizar | Lizar can collect email accounts from Microsoft Outlook and Mozilla Thunderbird. |
| ToolMailSniper | MailSniper can be used to obtain account names from Exchange and Office 365 using the |
| ToolRuler | Ruler can be used to enumerate Exchange users and dump the GAL. |
| Used by | Procedure example |
|---|---|
| CampaignC0027 | During C0027, Scattered Spider accessed Azure AD to identify email addresses. |
| CampaignHomeLand Justice | During HomeLand Justice, threat actors used compromised Exchange accounts to search mailboxes for administrator accounts. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
