T1087.003 — Email Account

Tactic: Discovery · Platforms: Windows, Office Suite

Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs). In on-premises Exchange and Exchange Online, the Get-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and…

Sub-technique of Account Discovery (T1087).

Sigma detection rules (2)

T1087.003 Account Discovery: Email Account

title: "T1087.003 Account Discovery: Email Account"
id: d1dcdc35-0f00-4fdf-8563-9654cf34e1c8
description: 'Enumeration of Global Address Lists via Email Account Discovery. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: CommandLinePattern, HostRole, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1087/003
author: Shahrukh Khan
date: 2026-06-29
license: MIT
tags:
  - attack.discovery
  - attack.t1087.003

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    CommandLine|contains:
      - 'Get-GlobalAddressList'
      - 'Get-Recipient'
      - 'Get-Mailbox'
      - 'Get-Contact'
      - 'Get-MailContact'
      - 'Get-DistributionGroupMember'

  condition: selection

falsepositives:
  - Routine Exchange/Exchange Online administration (mailbox audits, distribution list or contact management) by IT staff using the same cmdlets.

level: informational

T1087.003 Account Discovery: Email Account

title: "T1087.003 Account Discovery: Email Account"
id: c0a70bc4-b651-45ce-9b73-681e02cc175f
description: 'Enumeration of Global Address Lists via Email Account Discovery. (Data Component: User Account Metadata; baseline tier: fallback.) Tune using: APIQueryVolume, UserContext, AppSource.'
references:
  - https://attack.mitre.org/techniques/T1087/003
author: Shahrukh Khan
date: 2026-04-07
license: MIT
tags:
  - attack.discovery
  - attack.t1087.003

logsource:
  product: gcp
  service: audit

detection:
  selection:
    protoPayload.methodName: 'google.iam.admin.v1.ListServiceAccounts'
    protoPayload.serviceName: 'iam.googleapis.com'

  condition: selection

falsepositives:
  - Cloud asset inventory tools and compliance scanners that routinely enumerate service accounts across projects.

level: informational

Related sub-techniques

Explore