RedCurlG1039 ↗
- Tactic
- Discovery
- Platforms
- Windows, Office Suite
- Version
- 1.2
- Created
- 21 February 2020
- Last modified
- 04 August 2026
Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
4
Threat groups70th pct
Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.9
Tools & malware73rd pct
Tools & malware73rd percentile · 73% of ATT&CK techniques have this many tools implementing them or fewer.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Email Account MITRE reference T1087.003
70th pctamong all ATT&CK techniques for number of groups
4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
TA505G0092 ↗
Has used the tool EmailStealer to steal and send lists of e-mail addresses to a remote server.1
Magic HoundG0059 ↗
Has used Powershell to discover email accounts.1
Sandworm TeamG0034 ↗
Used malware to enumerate email settings, including usernames and passwords, from the M.E.Doc application.1
All 4 groups for this technique
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
C0027C0027 ↗
During C0027, Scattered Spider accessed Azure AD to identify email addresses.1
HomeLand JusticeC0038 ↗
During HomeLand Justice, threat actors used compromised Exchange accounts to search mailboxes for administrator accounts.1
All 2 campaigns for this technique
9 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Kali365S9044 ↗
Has leveraged an Exchange Admin module that utilizes Graph to enumerate mailboxes in victim environments.1
LizarS0681 ↗
Can collect email accounts from Microsoft Outlook and Mozilla Thunderbird.1
BoomBoxS0635 ↗
Can execute an LDAP query to discover e-mail accounts for domain users.1
GrandoreiroS0531 ↗
Can parse Outlook .pst files to extract e-mail addresses.1
MailSniperS0413 ↗
Can be used to obtain account names from Exchange and Office 365 using the Get-GlobalAddressList cmdlet.1
EmotetS0367 ↗
Has been observed leveraging a module that can scrape email addresses from Outlook.123
All 9 software entries for this technique · 6 newest in this preview
Offense vs defense T1087.003
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Email Account detection strategy DET0229
MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Enumeration of Global Address Lists via Email Account Discovery
2 platforms
AN0641 · Windows
Enumeration of global address lists or email account metadata via PowerShell cmdlets (e.g., Get-GlobalAddressList) or MAPI/RPC from non-admin, non-mailserver systems.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Command ExecutionDC0064 | WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CommandLinePattern | Match variations of Get-GlobalAddressList, Get-Recipient, and related cmdlets. |
| HostRole | Suppress expected usage on Exchange servers or known IT admin consoles. |
| TimeWindow | Detect bulk execution patterns in short intervals, often used during recon. |
AN0642 · Office Suite
Suspicious querying of organization-wide directory data via Google Workspace Directory API or Outlook GAL sync in high volume from abnormal users, service accounts, or unknown device contexts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | azure:signinlogs | Unusual Token Usage or Application Consent |
| User Account MetadataDC0013 | gcp:audit | Directory API Access: users.list or groups.list |
| Application Log ContentDC0038 | m365:unified | GAL Lookup or Address Book download |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| APIQueryVolume | Set thresholds for excessive use of 'users.list' or recursive group enumerations. |
| UserContext | Flag non-admin or previously unseen user agents requesting directory information. |
| AppSource | Distinguish between sanctioned sync tools and unauthorized scripts or OAuth tokens. |