Threat intelligence / Technique

Email Account

Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists) In on-premises Exchange and Exchange Online, the Get-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016) In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List)

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists) In on-premises Exchange and Exchange Online, the Get-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016) In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List)

16 recorded

Relationships

subtechnique-of

to Account Discovery

Technique

uses

from Backdoor.Oldrea

Malware

uses

Malware

uses

from C0027

Campaign

uses

Malware

uses

from Grandoreiro

Malware

uses

from HomeLand Justice

Campaign

uses

Malware

uses

from Lizar

Malware

uses

from Magic Hound

Group

uses

from MailSniper

Tool

uses

Group

uses

from Ruler

Tool

uses

from Sandworm Team

Group

uses

from TA505

Group

uses

Malware

5 external

References

mitre-attack

T1087.003

Black Hills Attacking Exchange MailSniper, 2016

https://www.blackhillsinfosec.com/attacking-exchange-with-mailsniper/

Google Workspace Global Access List

https://support.google.com/a/answer/166870?hl=en

Microsoft Exchange Address Lists

https://docs.microsoft.com/en-us/exchange/email-addresses-and-address-books/address-lists/address-lists?view=exchserver-2019

Microsoft getglobaladdresslist

https://docs.microsoft.com/en-us/powershell/module/exchange/email-addresses-and-address-books/get-globaladdresslist