MITRE ATT&CKsub-technique
T1087.003 Email Account
- Domain
- enterprise
- Tactics
- Discovery
- Platforms
- Windows, Office Suite
- Version
- 1.2
- Created
- 2020-02-21
Description
Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).
In on-premises Exchange and Exchange Online, the Get-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.
In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.
Related
Subtechnique of · MITRE ATT&CK (1)
- T1087 Account Discovery technique
Tactic · MITRE ATT&CK (1)
- TA0007 Discovery tactic
Referenced by MITRE ATT&CK · uses (15)
- S9044 Kali365 software (malware)
- G1039 RedCurl group
- C0038 HomeLand Justice campaign
- C0027 C0027 campaign
- S0681 Lizar software (malware)
- S0635 BoomBox software (malware)
- S0531 Grandoreiro software (malware)
- S0413 MailSniper software (tool)
- G0092 TA505 group
- S0367 Emotet software (malware)
- S0358 Ruler software (tool)
- S0266 TrickBot software (malware)
- G0059 Magic Hound group
- G0034 Sandworm Team group
- S0093 Backdoor.Oldrea software (malware)
References
- https://www.blackhillsinfosec.com/attacking-exchange-with-mailsniper/ Black Hills Attacking Exchange MailSniper, 2016
- https://support.google.com/a/answer/166870?hl=en Google Workspace Global Access List
- https://docs.microsoft.com/en-us/exchange/email-addresses-and-address-books/address-lists/address-lists?view=exchserver-2019 Microsoft Exchange Address Lists
- https://docs.microsoft.com/en-us/powershell/module/exchange/email-addresses-and-address-books/get-globaladdresslist Microsoft getglobaladdresslist