Email Addresses (T1589.002)

Tactic: Reconnaissance

Tactics
Reconnaissance
Platforms
PRE
Reference
attack.mitre.org/techniques/T1589.002

Description

Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees.

Adversaries may easily gather email addresses, since they may be readily available and exposed via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites).(Citation: HackersArise Email)(Citation: CNET Leaks) Email addresses could also be enumerated via more active means (i.e. Active Scanning), such as probing and analyzing responses from authentication services that may reveal valid usernames in a system.(Citation: GrimBlog UsernameEnum) For example, adversaries may be able to enumerate email addresses in Office 365 environments by querying a variety of publicly available API endpoints, such as autodiscover and GetCredentialType.(Citation: GitHub Office 365 User Enumeration)(Citation: Azure Active Directory Reconnaisance)

Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Email Accounts), and/or initial access (ex: Phishing or Brute Force via External Remote Services).

How GTK Cyber trains on this

GTK Cyber's hands-on training programs cover detection engineering across the MITRE ATT&CK framework, including the Reconnaissance tactic this technique falls under. Our practitioner-led courses focus on building real detections, not just memorizing technique IDs.

View training courses →

Related techniques

Train your team on real attack techniques.

GTK Cyber's hands-on courses are taught by practitioners who detect this stuff for a living.

View Courses