kevmap

Techniques › T1087 › T1087.003

T1087.003 Email Account

discovery — Windows, Office Suite · attack.mitre.org · JSON

1
MITRE detection strategy
2
analytics
0
Sigma rules tagged attack.t1087.003
0
KEV CVEs mapped here
<p>Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).</p><p>In on-premises Exchange and Exchange Online, the <code>Get-GlobalAddressList</code> PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.</p><p>In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1087.003

No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.

Rules tagged at the parent level (attack.t1087) 16

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Malicious PowerShell Commandlets - ProcessCreation hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 (modified 2025-12-10) · logsource: product=windows category=process_creation · 02030f2f-6199-49ec-b258-ea71b07e03dc
Detects Commandlet names from well-known PowerShell exploitation frameworks
Techniques: T1482T1087T1087.001T1087.002T1069.001T1069.002T1069T1059.001
Hacktool Ruler hightest
Author: Florian Roth (Nextron Systems) · 2017-05-31 (modified 2022-10-09) · logsource: product=windows service=security · 24549159-ac1b-479c-8175-d42aea947cae
This events that are generated when using the hacktool Ruler by Sensepost
Techniques: T1087T1114T1059T1550.002
PUA - Seatbelt Execution hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2022-10-18 (modified 2023-02-04) · logsource: product=windows category=process_creation · 38646daa-e78f-4ace-9de0-55547b2d30da
Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters
Techniques: T1526T1087T1083
Webshell Hacking Activity Patterns hightest
Author: Florian Roth (Nextron Systems) · 2022-03-17 (modified 2023-11-09) · logsource: product=windows category=process_creation · 4ebc877f-4612-45cb-b3a5-8e3834db36c9
Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system
Techniques: T1505.003T1018T1033T1087
SharpHound Recon Account Discovery hightest
Author: Sagie Dulce, Dekel Paz · 2022-01-01 · logsource: product=rpc_firewall category=application · 65f77b1e-8e79-45bf-bb67-5988a8ce45a5
Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.
Techniques: T1087
Potential Pikabot Discovery Activity hightest
Author: Andreas Braathen (mnemonic.io) · 2023-10-27 (modified 2024-01-26) · logsource: product=windows category=process_creation · 698d4431-514f-4c82-af4d-cf573872a9f5
Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups. The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).
Techniques: T1016T1049T1087
Malicious PowerShell Commandlets - PoshModule hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-20 (modified 2025-12-10) · logsource: product=windows category=ps_module · 7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c
Detects Commandlet names from well-known PowerShell exploitation frameworks
Techniques: T1482T1087T1087.001T1087.002T1069.001T1069.002T1069T1059.001
Malicious PowerShell Commandlets - ScriptBlock hightest
Author: Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer · 2017-03-05 (modified 2025-12-10) · logsource: product=windows category=ps_script · 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
Detects Commandlet names from well-known PowerShell exploitation frameworks
Techniques: T1482T1087T1087.001T1087.002T1069.001T1069.002T1069T1059.001
HackTool - winPEAS Execution hightest
Author: Georg Lauenstein (sure[secure]) · 2022-09-19 (modified 2023-03-23) · logsource: product=windows category=process_creation · 98b53e78-ebaf-46f8-be06-421aafd176d9
WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz
Techniques: T1082T1087T1046
Suspicious Use of PsLogList mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2021-12-18 (modified 2026-06-29) · logsource: product=windows category=process_creation · aae1243f-d8af-40d8-ab20-33fc6d0c55bc
Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs
Techniques: T1087T1087.001T1087.002
Uncommon Connection to Active Directory Web Services mediumtest
Author: @kostastsale · 2024-01-26 · logsource: product=windows category=network_connection · b3ad3c0f-c949-47a1-a30e-b0491ccae876
Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.
Techniques: T1087
Potentially Suspicious EventLog Recon Activity Using Log Query Utilities mediumtest
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · 2022-09-09 (modified 2025-12-02) · logsource: product=windows category=process_creation · beaa66d6-aa1b-4e3c-80f5-e0145369bfaf
Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs. This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc.
Techniques: T1552T1087
Webshell Detection With Command Line Keywords hightest
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson · 2017-01-01 (modified 2026-07-14) · logsource: product=windows category=process_creation · bed2a484-9348-4143-8a8a-b801c979301c
Detects certain command line parameters often used during reconnaissance activity via web shells
Techniques: T1505.003T1018T1033T1087
Network Reconnaissance Activity hightest
Author: Florian Roth (Nextron Systems) · 2022-02-07 · logsource: product=windows category=process_creation · e6313acd-208c-44fc-a0ff-db85d572e90e
Detects a set of suspicious network related commands often used in recon stages
Techniques: T1087T1082
HackTool - SOAPHound Execution hightest
Author: @kostastsale · 2024-01-26 · logsource: product=windows category=process_creation · e92a4287-e072-4a40-9739-370c106bb750
Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.
Techniques: T1087
Chopper Webshell Process Pattern hightest
Author: Florian Roth (Nextron Systems), MSTI (query) · 2022-10-01 · logsource: product=windows category=process_creation · fa3c117a-bc0d-416e-a31b-0c0e80653efb
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells
Techniques: T1505.003T1018T1033T1087