Global address list enumeration in a PowerShell script block

Siemphony@siemphonymediumT1087.003unverified

Matches the scripted half of AN0641: a PowerShell script block naming an Exchange address-book cmdlet or one of the published mail-harvesting functions that read a global address list. MITRE's `CommandLinePattern` knob asks for variations of Get-GlobalAddressList, Get-Recipient and related cmdlets; the term list below is that knob populated here with the address-list and distribution-group readers plus the MailSniper harvest functions, and the values are authored, not supplied by MITRE. Get-Mailbox is deliberately left out. It is how a large share of routine mailbox administration begins, and as a `contains` term it would also catch Get-MailboxStatistics, Get-MailboxDatabase and Get-MailboxFolderStatistics — the same reason Connect-ExchangeOnline is excluded from this corpus's T1114.002 rule. Expect one deliberate overlap with that rule: it also carries Get-GlobalAddressList, as a mail-harvesting toolkit term, so a script that calls the cmdlet will alert under both technique ids. `ScriptBlockText` holds the script as the engine compiled it, so an `-EncodedCommand` payload arrives decoded — but decoded is not deobfuscated. Name splitting (`"Get-Global"+"AddressList"`), backtick insertion and wildcard command resolution (`&(gcm Get-Global*)`) all survive compilation and defeat every literal term here. AN0641's Sysmon EventID 1 arm is not used: Exchange cmdlets are normally issued inside an already-established remote session, so the cmdlet name reaches a process `CommandLine` only in the one-liner form and process creation would miss the ordinary case. The brief also lists EventIDs 4103, 4105 and 4106; 4103 module-logging records carry the same names in `Payload` rather than `ScriptBlockText`, which needs a separate rule with a different field, so this one selects 4104 only. MITRE's `HostRole` knob — suppress expected usage on Exchange servers and known IT admin consoles — has no field in a single 4104 record and has to be applied when the rule is deployed, and its `TimeWindow` knob is a burst over an interval that Sigma does not model. EventID 4104 requires *Script Block Logging* to be enabled by policy; it is off in a default install, and with it off this rule returns zero rows, which reads as quiet when it means blind. The rule can also only see hosts whose PowerShell is logged — a direct Graph or EWS call, an OWA session in a browser, or an unmanaged machine writes nothing here, and the Office Suite half of this technique lives in the tenant's own audit log rather than in any Windows event channel. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0229, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

Event| where (EventID == 4104 and (ScriptBlockText contains "Get-GlobalAddressList" or ScriptBlockText contains "Get-AddressList" or ScriptBlockText contains "Get-OfflineAddressBook" or ScriptBlockText contains "Get-Recipient" or ScriptBlockText contains "Get-EXORecipient" or ScriptBlockText contains "Get-DistributionGroupMember" or ScriptBlockText contains "Get-DynamicDistributionGroupMember" or ScriptBlockText contains "Invoke-DomainHarvestOWA" or ScriptBlockText contains "Invoke-UsernameHarvestOWA" or ScriptBlockText contains "Invoke-UsernameHarvestSMTP" or ScriptBlockText contains "Invoke-UsernameHarvestEWS"))

Splunk · SPL

Run this as a search.

index=* (EventID="4104" AND (ScriptBlockText="*Get-GlobalAddressList*" OR ScriptBlockText="*Get-AddressList*" OR ScriptBlockText="*Get-OfflineAddressBook*" OR ScriptBlockText="*Get-Recipient*" OR ScriptBlockText="*Get-EXORecipient*" OR ScriptBlockText="*Get-DistributionGroupMember*" OR ScriptBlockText="*Get-DynamicDistributionGroupMember*" OR ScriptBlockText="*Invoke-DomainHarvestOWA*" OR ScriptBlockText="*Invoke-UsernameHarvestOWA*" OR ScriptBlockText="*Invoke-UsernameHarvestSMTP*" OR ScriptBlockText="*Invoke-UsernameHarvestEWS*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (event.code == 4104 AND (TO_LOWER(powershell.file.script_block_text) LIKE "*get-globaladdresslist*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*get-addresslist*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*get-offlineaddressbook*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*get-recipient*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*get-exorecipient*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*get-distributiongroupmember*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*get-dynamicdistributiongroupmember*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*invoke-domainharvestowa*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*invoke-usernameharvestowa*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*invoke-usernameharvestsmtp*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*invoke-usernameharvestews*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^4104$</field>    <field name="ScriptBlockText" type="pcre2">(?i)(Get-GlobalAddressList|Get-AddressList|Get-OfflineAddressBook|Get-Recipient|Get-EXORecipient|Get-DistributionGroupMember|Get-DynamicDistributionGroupMember|Invoke-DomainHarvestOWA|Invoke-UsernameHarvestOWA|Invoke-UsernameHarvestSMTP|Invoke-UsernameHarvestEWS)</field>    <description>Global address list enumeration in a PowerShell script block</description>    <mitre>      <id>T1087.003</id>    </mitre>  </rule></group>

At a glance

Logsource: powershell / windows
Level: medium
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: cf3a5de4-27ce-42a4-bacd-15fda262413f

ATT&CKT1087.003

T1087.003Email Account

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

A PowerShell script block that names an Exchange address-book cmdlet or one of the published mail-harvesting functions that read a global address list. This is the scripted half of AN0641 — an adversary pulling the organisation's address book to build a target list for phishing or lateral movement. The MAPI/RPC half, and the Office Suite half that lives in the tenant's own audit log, are not covered by this rule.

02 · Telemetry you need

The Microsoft-Windows-PowerShell/Operational channel — logsource product: windows, service: powershell, copied verbatim from AN0641 — with EventID 4104. That requires Script Block Logging enabled by policy; it is off in a default install, and with it off the rule returns zero rows, which reads as quiet when it means blind. There is a second half to that trap: with the policy on, ordinary blocks are emitted at Verbose and only blocks PowerShell itself judges suspicious are emitted at Warning. None of these cmdlets are on that list, so every match depends on a Verbose 4104. If your forwarder or ingest filters Verbose to control volume, you get the same silent blindness with the policy showing as enabled.

03 · How the logic works

A single selection: EventID: 4104 ANDed with ScriptBlockText|contains across eleven terms. Seven are Exchange readers — Get-GlobalAddressList, Get-AddressList, Get-OfflineAddressBook, Get-Recipient, Get-EXORecipient, Get-DistributionGroupMember, Get-DynamicDistributionGroupMember — and four are MailSniper harvest functions (Invoke-DomainHarvestOWA, Invoke-UsernameHarvestOWA, -SMTP, -EWS). This term list is MITRE's CommandLinePattern knob populated with values authored by this pipeline; MITRE asks for "variations of Get-GlobalAddressList, Get-Recipient and related cmdlets" and supplies no list. Get-Mailbox is deliberately absent: it opens a large share of routine mailbox administration and, as a substring, would also drag in Get-MailboxStatistics and Get-MailboxDatabase. ScriptBlockText holds the block as the engine compiled it, so -EncodedCommand arrives decoded — but decoded is not deobfuscated. Name splitting ("Get-Global"+"AddressList"), backticks and &(gcm Get-Global*) all survive compilation and defeat every literal term here. MITRE's HostRole and TimeWindow knobs have no expression in one 4104 record and must be applied at deployment.

04 · Common false positives

Joiner/mover/leaver and mailbox-provisioning runbooks calling Get-Recipient per identity under a service account — the densest recurring match by a wide margin. Messaging administrators running the address-list cmdlets as ordinary troubleshooting: the same commands, run by the team whose job it is. Distribution-list hygiene and org-chart reporting walking Get-DistributionGroupMember nightly. Address-book sync connectors for CRM, telephony and MDM. Authorised phishing simulations, where MailSniper is standard. And substring collisions — Get-Recipient also matches Get-RecipientPermission and Get-RecipientFilterConfig.

05 · Detection maturity

tier_1: Lowest tier, and it stays there until it has been run against real data. Every field is real for 4104 and it renders in four backends, but neither fact is evidence it fires. medium sits at the ceiling of what six mostly-scheduled false positives support; without a service-account allowlist, low is honest.

Tuning & false positivesexperimental · 6 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Allowlist the provisioning service accounts and the messaging admins' hosts first; that is HostRole applied with your own values, and it is a prerequisite rather than a refinement. If the rule is still loud, drop Get-Recipient — it is the broadest term by far and will produce most of the volume and almost none of the true positives, while the other ten stand on their own. Expect a deliberate overlap with this corpus's T1114.002 rule, which also carries Get-GlobalAddressList. Adding the 4103 module-logging arm needs a separate rule keyed on Payload, not ScriptBlockText.

Declared by the author

Joiner, mover and leaver automation and mailbox provisioning runbooks that call Get-Recipient once per identity on a schedule under a service account. This is the densest recurring match by a wide margin, and allowlisting those service accounts is the first tuning step rather than an optional refinement.
Exchange and messaging administrators running Get-GlobalAddressList, Get-AddressList and Get-OfflineAddressBook as ordinary address-book and offline-address-book troubleshooting — the same cmdlets an adversary reaches for, run by the team whose job it is.
Distribution-list hygiene and org-chart reporting scripts that walk Get-DistributionGroupMember across every group in the tenant on a nightly timer.
Address-book synchronisation connectors for CRM, telephony and mobile device management platforms, which pull the global address list on an interval to populate their own directory copy.
Authorised phishing simulation and red-team assessment work, where MailSniper is the standard tool and Invoke-DomainHarvestOWA and Invoke-UsernameHarvestOWA are its address-discovery functions.
Substring collisions on Get-Recipient, which also matches Get-RecipientPermission, Get-RecipientFilterConfig and Get-RecipientStatisticsReport — configuration and reporting reads with no address enumeration in them.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1087.003, evaluated against their — events.

Share this rule

/u/siemphony/cf3a5de4-27ce-42a4-bacd-15fda262413f

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Global address list enumeration in a PowerShell script block

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it