Automation · API / MCP 中文

Technique note · T1589.002

Email Addresses

Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees. Adversaries may easily gather email addresses, since they may be readily available and exposed via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Email addresses could also be enumerated via more active means (i.e. Active Scanning), such as probing and analyzing responses from authentication services that may reveal valid usernames in a system. For example, adversaries may be able to enumerate email addresses in Office 365 environments by querying a variety of publicly available API endpoints, such as autodiscover and GetCredentialType. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Email Accounts), and/or initial access (ex: Phishing or Brute Force via External Remote Services).

ATT&CK T1589.002 platforms — Status Active Version 20.1

Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees. Adversaries may easily gather email addresses, since they may be readily available and exposed via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites).12 Email addresses could also be enumerated via more active means (i.e. Active Scanning), such as probing and analyzing responses from authentication services that may reveal valid usernames in a system.3 For example, adversaries may be able to enumerate email addresses in Office 365 environments by querying a variety of publicly available API endpoints, such as autodiscover and GetCredentialType.45 Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Email Accounts), and/or initial access (ex: Phishing or Brute Force via External Remote Services).

  1. HackersArise Email
  2. CNET Leaks
  3. GrimBlog UsernameEnum
  4. GitHub Office 365 User Enumeration
  5. Azure Active Directory Reconnaisance

Groups using this technique

GroupNameCountry
grp_g1011EXOTIC LILY—
grp_g0122Silent Librarian—
grp_g1031Saint BearRussia
grp_g0127TA551—
grp_g0032Lazarus GroupDPRK
grp_g1001HEXANE—
grp_g1036Moonstone SleetDPRK
grp_g1004LAPSUS$—
grp_g1017Volt Typhoon—
grp_g0125HAFNIUM—
grp_g0094KimsukyDPRK
grp_g0059Magic HoundIran
grp_g0034Sandworm TeamRussia
grp_g0050APT32Vietnam

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.