T1087.003: 电子邮件账户
摘要
攻击者可能尝试获取电子邮件地址和账户的列表。攻击者可能尝试转储 Exchange 地址列表，例如全局地址列表(GAL)。(Citation: Microsoft Exchange Address Lists) 在本地 Exchange 和 Exchange Online 中，<code>Get-GlobalAddressList</code> PowerShell cmdlet 可用于使用经过身份验证的会话从域中获取电子邮件地址和账户。(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016) 在 Google Workspace 中，GAL 通过 Google Workspace Sync for Microsoft Outlook (GWSMO) 服务与 Microsoft Outlook 用户共享。此外，Google Workspace Directory 允许用户获取组织内其他用户的列表。(Citation: Google Workspace Global Access List)
来源归属
来源：MITRE ATT&CK · 置信度：high
平台
- Windows
- Office Suite
战术
发现
参考来源
- https://attack.mitre.org/techniques/T1087/003
- https://www.blackhillsinfosec.com/attacking-exchange-with-mailsniper/
- https://support.google.com/a/answer/166870?hl=en
- https://docs.microsoft.com/en-us/exchange/email-addresses-and-address-books/address-lists/address-lists?view=exchserver-2019
- https://docs.microsoft.com/en-us/powershell/module/exchange/email-addresses-and-address-books/get-globaladdresslist