CyberStack

MITRE ATT&CK / Techniques / T1087.003

Account Discovery: Email Account

ID
T1087.003
Tactics
TA0007 Discovery
Sub-technique of
T1087 Account Discovery
Platforms
Windows, Office Suite
Data sources
Command Execution, Process Creation, User Account Metadata, Application Log Content, User Account Authentication
Source
attack.mitre.org
MITRE last modified
5 Aug 2026

Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).[1]

In on-premises Exchange and Exchange Online, the Get-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.[2][3]

In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.[4]

Detection

Groups (4)

Software (9)

References

  1. Microsoft Exchange Address Lists
  2. Microsoft getglobaladdresslist
  3. Black Hills Attacking Exchange MailSniper, 2016
  4. Google Workspace Global Access List