T1087.003: Email Account
Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).[1]
In on-premises Exchange and Exchange Online, the Get-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.[2][3]
In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.[4]
Analyst context for executives and security teams
Email Account discovery is the seemingly simple act of collecting valid corporate email addresses from systems such as Exchange, Exchange Online, Google Workspace Directory, or shared global address lists. Its business significance is that a directory can become an attacker’s map of the organization: who exists, which accounts are real, and which identities may be useful for follow-on activity such as phishing, brute forcing, or account takeover as described in the parent Account Discovery technique.
Executive priority
Prioritize this as an identity and mail-platform visibility issue rather than only an endpoint issue. Leaders should ask whether the organization can prove who is enumerating address lists, from where, and under which authenticated session. The control decision is usually about reducing unnecessary directory exposure, validating mail and identity audit coverage, and ensuring SOC/IR teams can distinguish normal address book use from unusual bulk enumeration during an incident.
Technical view
This sub-technique applies to Windows and Office Suite environments and sits under Discovery. ATT&CK specifically calls out dumping Exchange address lists/GALs and use of the Exchange PowerShell Get-GlobalAddressList cmdlet from an authenticated session, as well as Google Workspace Directory and GWSMO exposure of the GAL to Outlook users. Because official ATT&CK detection text is not provided, teams should use the related DET0229 strategy as a starting point and validate local logging for authenticated directory/address-list enumeration, Exchange PowerShell activity, mail service access, and identity-session context.
Likely telemetry
- Exchange / Exchange Online administrative and PowerShell audit logs, including Get-GlobalAddressList where logged
- Mail platform audit records for address list or GAL access
- Google Workspace Directory audit or admin logs relevant to user directory lookups and GAL sharing
- Identity provider sign-in/session logs for the authenticated account performing enumeration
- Windows endpoint telemetry for PowerShell or command-line activity interacting with Exchange services
Detection direction
- Validate whether DET0229-style logic is implemented and mapped to this technique in the detection library.
- Baseline legitimate GAL and directory access by administrators, help desk staff, mail clients, and synchronization services to reduce false positives.
- Look for unusual volume, timing, source location, new device/session context, or non-standard tooling around address-list enumeration.
- Correlate enumeration with the parent Account Discovery context, especially subsequent authentication attempts, phishing preparation, or other identity-focused activity.
- Treat lack of official ATT&CK detection guidance as a reason to test logging coverage directly rather than assuming EDR or mail security tools will surface the behavior.
Mitigation priorities
- Confirm mail and directory audit logging is enabled and retained long enough to support incident response.
- Review who can access broad address lists and who can run Exchange PowerShell or directory-related administrative functions.
- Reduce unnecessary directory visibility where business processes do not require broad user discovery.
- Strengthen identity controls around mail and directory access so that authenticated enumeration can be tied to a known user, device, and session.
- Include GAL and email account enumeration checks in incident response playbooks for suspected mailbox, identity, or social-engineering incidents.
Analyst notes and limits
This technique has broad relationship context: it is used by multiple campaigns, groups, and software entries in ATT&CK, and it is a sub-technique of Account Discovery. That breadth suggests defenders should treat email-directory enumeration as a common enabling behavior, not as a standalone incident conclusion. The most useful local evidence will be mail-platform audit logs, identity session data, and endpoint command execution around Exchange or Office tooling.
MITRE provides no official detection text for this object. The supplied fields support Exchange, Exchange Online, Google Workspace Directory, GWSMO, Windows, and Office Suite context, but they do not prove exposure in any specific environment or guarantee that a given product will detect the activity. Local configuration, logging, and directory-sharing settings determine practical coverage.
Email Account
Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).[1]
In on-premises Exchange and Exchange Online, the Get-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.[2][3]
In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.[4]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1087 | Account Discovery | This object subtechnique of Account Discovery. |
Groups, software, and campaigns
G0092: TA505
G0059: Magic Hound
Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.[1][2][3][4][5]
G1039: RedCurl
RedCurl is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks.[1] RedCurl is allegedly a Russian-speaking threat actor.[1][2] The group’s operations typically start with spearphishing emails to gain initial access, then the group executes discovery and collection commands and scripts to find corporate data. The group concludes operations by exfiltrating files to the C2 servers.
G0034: Sandworm Team
Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.[1][2] This group has been active since at least 2009.[3][4][5][6]
In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide NotPetya attack, targeting of the 2017 French presidential campaign, the 2018 Olympic Destroyer attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.[1][2] Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as APT28.[7]
S0531: Grandoreiro
Grandoreiro is a banking trojan written in Delphi that was first observed in 2016 and uses a Malware-as-a-Service (MaaS) business model. Grandoreiro has confirmed victims in Brazil, Mexico, Portugal, and Spain.[1][2]
S0093: Backdoor.Oldrea
Backdoor.Oldrea is a modular backdoor that used by Dragonfly against energy companies since at least 2013. Backdoor.Oldrea was distributed via supply chain compromise, and included specialized modules to enumerate and map ICS-specific systems, processes, and protocols.[1][2][3]
S0266: TrickBot
TrickBot is a Trojan spyware program written in C++ that first emerged in September 2016 as a possible successor to Dyre. TrickBot was developed and initially used by Wizard Spider for targeting banking sites in North America, Australia, and throughout Europe; it has since been used against all sectors worldwide as part of "big game hunting" ransomware campaigns.[1][2][3][4]
S0681: Lizar
S0358: Ruler
S0413: MailSniper
MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). It can be used by a non-administrative user to search their own email, or by an Exchange administrator to search the mailboxes of every user in a domain.[1]
S0367: Emotet
S0635: BoomBox
C0027: C0027
C0027 was a financially-motivated campaign linked to Scattered Spider that targeted telecommunications and business process outsourcing (BPO) companies from at least June through December of 2022. During C0027 Scattered Spider used various forms of social engineering, performed SIM swapping, and attempted to leverage access from victim environments to mobile carrier networks.[1]
C0038: HomeLand Justice
HomeLand Justice was a disruptive cyber campaign conducted by Iranian state-affiliated actors against Albanian government networks in July and September 2022. The activity combined ransomware, wiper malware, and data leak operations. Initial access for HomeLand Justice was established as early as May 2021, and threat actors moved laterally, exfiltrated sensitive information, and maintained persistence for approximately 14 months prior to the destructive phase of the operation. Responsibility was claimed by the "HomeLand Justice" front, which framed the campaign as retaliation against the Mujahedeen-e Khalq (MEK), an Iranian opposition group with a presence in Albania. Multiple Iran-nexus groups are assessed to have participated in the campaign, including HEXANE who probed victim infrastructure.[1][2][3] A second wave of attacks was launched in September 2022 using similar tactics following public attribution of the previous activity to Iran and the severing of diplomatic ties between Iran and Albania.[3]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.2 | Current bundle | 2a9abd33d86d… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Microsoft Exchange Address Lists
Microsoft. (2020, February 7). Address lists in Exchange Server. Retrieved March 26, 2020.
Open source URL -
[2]
Microsoft getglobaladdresslist
Microsoft. (n.d.). Get-GlobalAddressList. Retrieved October 6, 2019.
Open source URL -
[3]
Black Hills Attacking Exchange MailSniper, 2016
Bullock, B.. (2016, October 3). Attacking Exchange with MailSniper. Retrieved October 6, 2019.
Open source URL -
[4]
Google Workspace Global Access List
Google. (n.d.). Retrieved March 16, 2021.
Open source URL -
[5]
mitre-attack T1087.003Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.