Email Account discovery (T1087.003) is the sub-technique of Account Discovery that gathers email addresses and accounts. It is a discovery technique for Windows and Office Suite environments.
How attackers use it
MITRE says adversaries may try to get a list of email addresses and accounts, and may try to dump Exchange address lists such as global address lists (GALs).
- In on-premises Exchange and Exchange Online, the Get-GlobalAddressList PowerShell cmdlet can obtain addresses and accounts from a domain using an authenticated session.
- In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. The Google Workspace Directory also lets users list other users in the organization.
A complete address list is a ready made target list for phishing.
How to detect it
MITRE's strategy (DET0229) has two analytics:
- Enumeration of global address lists or email account metadata through PowerShell cmdlets such as Get-GlobalAddressList, or MAPI and RPC, from systems that are neither admin nor mail servers.
- Suspicious querying of organization-wide directory data through the Google Workspace Directory API or Outlook GAL sync, in high volume, from abnormal users, service accounts or unknown device contexts.
Mail audit logs, Exchange admin audit logs and Google Workspace audit logs are the sources to enable and retain.
How to reduce the risk
MITRE states that the technique cannot be easily mitigated with preventive controls because it abuses system features. Limit which users and applications may query the full directory, review third party apps that hold directory scopes, and alert on bulk lookups from accounts that do not normally perform them.
Quick check
Which cmdlet does MITRE name for pulling addresses from Exchange?
Get-GlobalAddressList, used in an authenticated session on on-premises Exchange or Exchange Online.
Sources
- MITRE ATT&CK, T1087.003 Email Account: https://attack.mitre.org/techniques/T1087/003/
