Email Account Discovery

A subject identifies or enumerates organizational email accounts, mailboxes, aliases, distribution lists, shared mailboxes, or other messaging identities in preparation for an infringement.

The subject may search a corporate address book, query an email administration interface, review message headers, enumerate valid recipients, export directory information, use scripts or application programming interfaces, or inspect configuration data containing email addresses.

Email account discovery may be used to identify targets for impersonation, social engineering, unauthorized mailbox access, information collection, or communication with selected members of the population. Particular concern should be given to enumeration of executive, legal, Human Resources, security, finance, shared, or otherwise sensitive mailboxes outside the subject’s normal responsibilities.

Investigators should assess the volume and pattern of searches, whether unusual address lists were exported, the subject’s legitimate communication requirements, and any subsequent messages, mailbox access, impersonation attempts, or credential activity involving the discovered accounts.