Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1087.003sub-technique of T1087 Account Discovery

Email Account

Windows · Office Suitenothing on this site yetT1087.003 on attack.mitre.org

Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs). In on-premises Exchange and Exchange Online, the `Get-GlobalAddressList` PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.

MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Enumeration of Global Address Lists via Email Account Discovery

  • Enumeration of global address lists or email account metadata via PowerShell cmdlets (e.g., Get-GlobalAddressList) or MAPI/RPC from non-admin, non-mailserver systems.
  • Suspicious querying of organization-wide directory data via Google Workspace Directory API or Outlook GAL sync in high volume from abnormal users, service accounts, or unknown device contexts.

the rest of T1087

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.