Global address list enumeration in a PowerShell script block

1title: Global address list enumeration in a PowerShell script block2id: cf3a5de4-27ce-42a4-bacd-15fda262413f3status: experimental4description: |5  Matches the scripted half of AN0641: a PowerShell script block naming an6  Exchange address-book cmdlet or one of the published mail-harvesting7  functions that read a global address list. MITRE's `CommandLinePattern` knob8  asks for variations of Get-GlobalAddressList, Get-Recipient and related9  cmdlets; the term list below is that knob populated here with the address-list10  and distribution-group readers plus the MailSniper harvest functions, and the11  values are authored, not supplied by MITRE.12  Get-Mailbox is deliberately left out. It is how a large share of routine13  mailbox administration begins, and as a `contains` term it would also catch14  Get-MailboxStatistics, Get-MailboxDatabase and Get-MailboxFolderStatistics —15  the same reason Connect-ExchangeOnline is excluded from this corpus's16  T1114.002 rule. Expect one deliberate overlap with that rule: it also carries17  Get-GlobalAddressList, as a mail-harvesting toolkit term, so a script that18  calls the cmdlet will alert under both technique ids.19  `ScriptBlockText` holds the script as the engine compiled it, so an20  `-EncodedCommand` payload arrives decoded — but decoded is not deobfuscated.21  Name splitting (`"Get-Global"+"AddressList"`), backtick insertion and wildcard22  command resolution (`&(gcm Get-Global*)`) all survive compilation and defeat23  every literal term here. AN0641's Sysmon EventID 1 arm is not used: Exchange24  cmdlets are normally issued inside an already-established remote session, so25  the cmdlet name reaches a process `CommandLine` only in the one-liner form and26  process creation would miss the ordinary case. The brief also lists EventIDs27  4103, 4105 and 4106; 4103 module-logging records carry the same names in28  `Payload` rather than `ScriptBlockText`, which needs a separate rule with a29  different field, so this one selects 4104 only.30  MITRE's `HostRole` knob — suppress expected usage on Exchange servers and31  known IT admin consoles — has no field in a single 4104 record and has to be32  applied when the rule is deployed, and its `TimeWindow` knob is a burst over33  an interval that Sigma does not model. EventID 4104 requires *Script Block34  Logging* to be enabled by policy; it is off in a default install, and with it35  off this rule returns zero rows, which reads as quiet when it means blind.36  The rule can also only see hosts whose PowerShell is logged — a direct Graph37  or EWS call, an OWA session in a browser, or an unmanaged machine writes38  nothing here, and the Office Suite half of this technique lives in the39  tenant's own audit log rather than in any Windows event channel.40  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0229, not hand-written and not tested by its author. Any lab result is on this rule's own page.41references:42  - https://attack.mitre.org/techniques/T1087/00343  - https://attack.mitre.org/detectionstrategies/DET022944author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)45date: 2026-08-1646tags:47  - attack.discovery48  - attack.t1087.00349logsource:50  product: windows51  service: powershell52detection:53  selection:54    EventID: 410455    ScriptBlockText|contains:56      - 'Get-GlobalAddressList'57      - 'Get-AddressList'58      - 'Get-OfflineAddressBook'59      - 'Get-Recipient'60      - 'Get-EXORecipient'61      - 'Get-DistributionGroupMember'62      - 'Get-DynamicDistributionGroupMember'63      - 'Invoke-DomainHarvestOWA'64      - 'Invoke-UsernameHarvestOWA'65      - 'Invoke-UsernameHarvestSMTP'66      - 'Invoke-UsernameHarvestEWS'67  condition: selection68falsepositives:69  - "Joiner, mover and leaver automation and mailbox provisioning runbooks that call Get-Recipient once per identity on a schedule under a service account. This is the densest recurring match by a wide margin, and allowlisting those service accounts is the first tuning step rather than an optional refinement."70  - "Exchange and messaging administrators running Get-GlobalAddressList, Get-AddressList and Get-OfflineAddressBook as ordinary address-book and offline-address-book troubleshooting — the same cmdlets an adversary reaches for, run by the team whose job it is."71  - "Distribution-list hygiene and org-chart reporting scripts that walk Get-DistributionGroupMember across every group in the tenant on a nightly timer."72  - "Address-book synchronisation connectors for CRM, telephony and mobile device management platforms, which pull the global address list on an interval to populate their own directory copy."73  - "Authorised phishing simulation and red-team assessment work, where MailSniper is the standard tool and Invoke-DomainHarvestOWA and Invoke-UsernameHarvestOWA are its address-discovery functions."74  - "Substring collisions on Get-Recipient, which also matches Get-RecipientPermission, Get-RecipientFilterConfig and Get-RecipientStatisticsReport — configuration and reporting reads with no address enumeration in them."75level: medium