Moonstone SleetG1036 ↗
Gathered victim email address information for follow-on phishing activity.1
tfMITRE ATT&CK sub-technique
Email Addresses T1589.002
sub-technique of T1589 Gather Victim Identity Information
- Tactic
- Reconnaissance
- Platform
- PRE
- Version
- 1.3
- Created
- 02 October 2020
- Last modified
- 12 May 2026
- Contributor
- Jannie Li, Microsoft Threat Intelligence Center (MSTIC)
Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
14
Threat groupsTop 13%
Threat groups87th percentile · 87% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.2
Detection rules50th pct
Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.Email Addresses MITRE reference T1589.002
Top 13%of all ATT&CK techniques for number of groups
14 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Saint BearG1031 ↗
Gathered victim email information in advance of phishing operations for targeted attacks.1
Volt TyphoonG1017 ↗
Has targeted the personal emails of key network and IT staff at victim organizations.1
EXOTIC LILYG1011 ↗
Has gathered targeted individuals' e-mail addresses through open source research and website contact forms.1
LAPSUS$G1004 ↗
Has gathered employee email addresses, including personal accounts, for social engineering and initial access efforts.1
TA551G0127 ↗
Has used spoofed company emails that were acquired from email clients on previously infected hosts to target other individuals.1
All 14 groups for this technique · 6 newest in this preview
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Quad7 ActivityC0055 ↗
Has gathered targeted individual’s e-mail addresses for the password spraying attempts.1
Water Curupira Pikabot DistributionC0037 ↗
Utilizes thread spoofing of existing email threads in order to execute spear phishing operations.1
All 2 campaigns for this technique
Offense vs defense T1589.002
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 2Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 1
first rule: 2022 Q1 · 2 of 2 campaigns plottedEmail Addresses detection strategy DET0814
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Email Addresses
1 platform
AN1946 · PRE
Monitor for suspicious network traffic that could be indicative of probing for email addresses and/or usernames, such as large/iterative quantities of authentication requests originating from a single source (especially if the source is known to be associated with an adversary/botnet). Analyzing web metadata may also reveal artifacts that can be attributed to potentially malicious activity, such as referer or user-agent string HTTP/S fields.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Network Traffic ContentDC0085 | Network Traffic | None |
Pre-compromiseM1056
This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on minimizing the amount and sensitivity of data available to external parties.