{
  "type": "attack-pattern",
  "spec_version": "2.1",
  "id": "attack-pattern--4bc31b94-045b-4752-8920-aebaebdb6470",
  "created": "2020-02-21T21:08:33.237Z",
  "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "revoked": false,
  "external_references": [
    {
      "source_name": "mitre-attack",
      "url": "https://attack.mitre.org/techniques/T1087/003",
      "external_id": "T1087.003"
    },
    {
      "source_name": "Black Hills Attacking Exchange MailSniper, 2016",
      "description": "Bullock, B.. (2016, October 3). Attacking Exchange with MailSniper. Retrieved October 6, 2019.",
      "url": "https://www.blackhillsinfosec.com/attacking-exchange-with-mailsniper/"
    },
    {
      "source_name": "Google Workspace Global Access List",
      "description": "Google. (n.d.). Retrieved March 16, 2021.",
      "url": "https://support.google.com/a/answer/166870?hl=en"
    },
    {
      "source_name": "Microsoft Exchange Address Lists",
      "description": "Microsoft. (2020, February 7). Address lists in Exchange Server. Retrieved March 26, 2020.",
      "url": "https://docs.microsoft.com/en-us/exchange/email-addresses-and-address-books/address-lists/address-lists?view=exchserver-2019"
    },
    {
      "source_name": "Microsoft getglobaladdresslist",
      "description": "Microsoft. (n.d.). Get-GlobalAddressList. Retrieved October 6, 2019.",
      "url": "https://docs.microsoft.com/en-us/powershell/module/exchange/email-addresses-and-address-books/get-globaladdresslist"
    }
  ],
  "object_marking_refs": [
    "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
  ],
  "modified": "2025-10-24T17:48:44.685Z",
  "name": "Email Account",
  "description": "Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists)\n\nIn on-premises Exchange and Exchange Online, the <code>Get-GlobalAddressList</code> PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016)\n\nIn Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List)",
  "kill_chain_phases": [
    {
      "kill_chain_name": "mitre-attack",
      "phase_name": "discovery"
    }
  ],
  "x_mitre_attack_spec_version": "3.2.0",
  "x_mitre_deprecated": false,
  "x_mitre_domains": [
    "enterprise-attack"
  ],
  "x_mitre_is_subtechnique": true,
  "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "x_mitre_platforms": [
    "Windows",
    "Office Suite"
  ],
  "x_mitre_version": "1.2"
}