MITRE ATT&CK technique · Reconnaissance

`T1589.002` Email Addresses

Sub-technique of T1589 Gather Victim Identity Information

Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees. Adversaries may easily gather email addresses, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001)…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

Sandworm

Sigma rules to hunt it

Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlockmediumexperimental · windows

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.