Techniques › T1087.003 › AN0641
AN0641 Analytic 0641
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Enumeration of global address lists or email account metadata via PowerShell cmdlets (e.g., Get-GlobalAddressList) or MAPI/RPC from non-admin, non-mailserver systems.</p>
- Detects
- T1087.003 Email Account
- Part of
- DET0229 Enumeration of Global Address Lists via Email Account Discovery
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 | DC0064 Command Execution |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
CommandLinePattern | Match variations of Get-GlobalAddressList, Get-Recipient, and related cmdlets. |
HostRole | Suppress expected usage on Exchange servers or known IT admin consoles. |
TimeWindow | Detect bulk execution patterns in short intervals, often used during recon. |