Email Addresses
Subtechnique · ATTACK:enterprise:T1589.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1589.002",
"title": "Email Addresses",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1589/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--69f897fd-12a9-4c89-ad6a-46d2f3c38262",
"external_id": "T1589.002",
"domain": "enterprise",
"created": "2020-10-02T14:56:24.866Z",
"modified": "2026-05-12T15:12:00.640Z",
"version": "1.3",
"aliases": [
],
"tactics": [
"reconnaissance"
],
"source_references": [
{
"source_name": "Azure Active Directory Reconnaisance",
"url": "https://o365blog.com/post/just-looking/"
},
{
"source_name": "GitHub Office 365 User Enumeration",
"url": "https://github.com/gremwell/o365enum"
},
{
"source_name": "GrimBlog UsernameEnum",
"url": "https://grimhacker.com/2017/07/24/office365-activesync-username-enumeration/"
},
{
"source_name": "HackersArise Email",
"url": "https://www.hackers-arise.com/email-scraping-and-maltego"
},
{
"source_name": "CNET Leaks",
"url": "https://www.cnet.com/news/massive-breach-leaks-773-million-emails-21-million-passwords/"
}
]
}Explicit source assertions (19)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c9ee6d6-b619-469f-8a61-d8514dc2ee31
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d805346-82fa-4912-99e7-a8a5fc112f90
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--297ca26b-2074-46ea-b81d-a0a5c6fe5ac0
Unit 42 TA551 Jan 2021ATTACK:enterprise:C0055 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4a6baa9b-c919-421b-8684-0ba7953bd8df
Medium 777-BotnetATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--55fd3f18-99b6-4c95-a2f3-e28962d73a91
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:M1056 → mitigates → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--611ad683-7772-4592-bbd4-e5589591a76e
ATTACK:enterprise:C0037 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e740c5b-250c-4122-a095-4ca31718d861
TrendMicro Pikabot 2024ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7104b56f-06ef-4888-ab9b-fac77fea3097
Kaspersky ThreatNeedle Feb 2021ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76bef74f-4820-4838-b56e-b59ae71ac170
Volexity Exchange Marauder March 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76ecca4d-15ba-4285-baa9-1cf03799dbeb
Google Iran Threats October 2021 · Proofpoint TA453 July2021ATTACK:enterprise:G0122 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--87661f05-f448-49be-afa8-d8198a1c0092
DOJ Iran Indictments March 2018ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9801b87a-29e0-4252-81e6-50bbc32d1940
Malwarebytes Kimsuky June 2021 · Proofpoint TA427 April 2024 · Mandiant APT43 March 2024ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a43dfdcf-380a-43ae-877f-891a01ed1c53
AADInternals Documentation · Azure AD ReconATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a57d19ce-7a9a-4be5-ae59-a0b331bcc03a
ClearSky Siamesekitten August 2021 · SecureWorks August 2019ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c2b48ab4-6a4f-4252-a40c-7f870276b5a7
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:T1589.002 → subtechnique-of → ATTACK:enterprise:T1589
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca38e574-09b1-4fc3-beb1-2af04189c05d
ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cbf49a08-de8a-483a-9732-230f9cc93002
Google EXOTIC LILY March 2022ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dcb3ae1c-c1a5-4a28-b206-40f8387804ac
Amnesty Intl. Ocean Lotus February 2021ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f425ddf8-fc3b-41d5-ba2e-66291ba16329
US District Court Indictment GRU Unit 74455 October 2020