T1087.003

Email Account

Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs). In on-premises Exchange and Exchange Online, the Get-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session. Threat actors including Magic Hound, TA505, RedCurl, and Sandworm Team have leveraged this technique using tools like MailSniper, Ruler, and custom malware to harvest email account information for reconnaissance, phishing, and lateral movement.

Microsoft Sentinel / Defender

kusto

let GALCmdlets = dynamic([
  "Get-GlobalAddressList", "Get-AddressList", "Get-OfflineAddressBook",
  "Get-Recipient", "Get-MailUser", "Get-Mailbox", "Get-GAL"
]);
let MailSniperPatterns = dynamic([
  "MailSniper", "Invoke-GlobalO365PasswordSpray", "Get-GlobalAddressList",
  "Invoke-SelfSearch", "Invoke-PasswordSprayOWA", "Invoke-PasswordSprayEWS"
]);
let OutlookPSTPatterns = dynamic([
  ".pst", ".ost", "OUTLOOK.EXE", "outlook.exe"
]);
// Detection 1: PowerShell GAL enumeration
let PSGALEnum = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (GALCmdlets) or ProcessCommandLine has_any (MailSniperPatterns)
| extend DetectionType = "PowerShell_GAL_Enumeration"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType;
// Detection 2: Exchange PowerShell remote session for address enumeration
let ExchangePSEnum = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has "ExchangeManagementShell" or
        (ProcessCommandLine has "New-PSSession" and ProcessCommandLine has_any ("outlook", "exchange", "office365", "outlook.office365.com")) or
        (ProcessCommandLine has "Connect-ExchangeOnline" and ProcessCommandLine has_any (GALCmdlets))
| extend DetectionType = "Exchange_Remote_Session_Enum"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType;
// Detection 3: LDAP queries targeting email attributes
let LDAPEmailEnum = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has "LDAP" and
        (ProcessCommandLine has "mail" or ProcessCommandLine has "proxyAddresses" or
         ProcessCommandLine has "targetAddress" or ProcessCommandLine has "msExch")
| extend DetectionType = "LDAP_Email_Attribute_Query"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType;
// Detection 4: Outlook PST/OST file access by non-Outlook processes
let OutlookFileEnum = DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has_any (".pst", ".ost")
| where not(InitiatingProcessFileName =~ "outlook.exe")
| where not(InitiatingProcessFileName in~ ("svchost.exe", "services.exe", "MicrosoftEdge.exe"))
| extend DetectionType = "Non_Outlook_PST_OST_Access"
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName,
         FileName = InitiatingProcessFileName,
         ProcessCommandLine = InitiatingProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType;
union PSGALEnum, ExchangePSEnum, LDAPEmailEnum, OutlookFileEnum
| sort by Timestamp desc

medium severity high confidence

Data Sources

Process: Process Creation Command: Command Execution File: File Access Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents DeviceFileEvents

False Positives

Exchange administrators legitimately running Get-GlobalAddressList or Get-Recipient cmdlets for address book management or auditing
Email migration tools (MigrationWiz, Bit Titan, IMAPMIG) accessing PST/OST files or querying address lists during migration projects
Backup software (Veeam Backup for Microsoft 365, Barracuda) accessing Outlook data files as part of scheduled backup jobs
IT helpdesk automation scripts using Exchange PowerShell to look up user mailbox information for troubleshooting
Third-party GAL synchronization tools used in hybrid Exchange environments accessing address list data

Splunk

spl

index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Security")
| eval is_process_event=if((sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" AND EventCode=1) OR (sourcetype="WinEventLog:Security" AND EventCode=4688), 1, 0)
| where is_process_event=1
| eval CommandLine=coalesce(CommandLine, Process_Command_Line)
| eval Image=coalesce(Image, New_Process_Name)
| eval CommandLineLower=lower(CommandLine)
| eval ImageLower=lower(Image)
| eval is_powershell=if(match(ImageLower, "(powershell\.exe|pwsh\.exe)"), 1, 0)
| eval GAL_Cmdlet=if(match(CommandLineLower, "(get-globaladdresslist|get-addresslist|get-offlineaddressbook|get-recipient|get-mailuser|get-mailbox)"), 1, 0)
| eval MailSniper=if(match(CommandLineLower, "(mailsniper|invoke-globalo365passwordspray|invoke-selfsearch|invoke-passwordsprayowa|invoke-passwordsprayews)"), 1, 0)
| eval Exchange_Remote=if(match(CommandLineLower, "(new-pssession.*exchange|connect-exchangeonline|exchangemanagementshell|outlook\.office365\.com)"), 1, 0)
| eval LDAP_Email=if(match(CommandLineLower, "(ldap.*(mail|proxyaddresses|targetaddress|msexch)|mail.*ldap|proxyaddresses.*ldap)"), 1, 0)
| eval Ruler_Tool=if(match(CommandLineLower, "(ruler.*brute|ruler.*dump|ruler.*enum|ruler.*gal)"), 1, 0)
| eval SuspicionScore=GAL_Cmdlet + MailSniper + Exchange_Remote + LDAP_Email + Ruler_Tool
| where (is_powershell=1 AND SuspicionScore > 0) OR MailSniper=1 OR Ruler_Tool=1
| eval DetectionCategories=mvappend(
    if(GAL_Cmdlet=1, "GAL_Cmdlet", null()),
    if(MailSniper=1, "MailSniper", null()),
    if(Exchange_Remote=1, "Exchange_Remote_Session", null()),
    if(LDAP_Email=1, "LDAP_Email_Query", null()),
    if(Ruler_Tool=1, "Ruler_Tool", null())
  )
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine,
         GAL_Cmdlet, MailSniper, Exchange_Remote, LDAP_Email, Ruler_Tool,
         SuspicionScore, DetectionCategories
| sort - _time

medium severity high confidence

Data Sources

Process: Process Creation Command: Command Execution Sysmon Event ID 1 Windows Security Event ID 4688

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational WinEventLog:Security

False Positives

Exchange administrators legitimately running Get-GlobalAddressList or Get-Recipient cmdlets for address book management or auditing
Email migration tools (MigrationWiz, Bit Titan) accessing address lists during migration projects
Backup software accessing Outlook data files or querying address lists as part of scheduled jobs
IT helpdesk automation scripts using Exchange PowerShell for user mailbox troubleshooting
Third-party GAL synchronization tools in hybrid Exchange environments

Elastic Security (EQL)

eql

any where
  (
    event.category == "process" and
    event.type == "start" and
    process.name : ("powershell.exe", "pwsh.exe") and
    (
      process.command_line : (
        "*Get-GlobalAddressList*",
        "*Get-AddressList*",
        "*Get-OfflineAddressBook*",
        "*Get-Recipient*",
        "*Get-MailUser*",
        "*Get-Mailbox*",
        "*MailSniper*",
        "*Invoke-GlobalO365PasswordSpray*",
        "*Invoke-SelfSearch*",
        "*Invoke-PasswordSprayOWA*",
        "*Invoke-PasswordSprayEWS*",
        "*Connect-ExchangeOnline*",
        "*ExchangeManagementShell*",
        "*ruler*gal*",
        "*ruler*dump*",
        "*ruler*enum*",
        "*ruler*brute*",
        "*New-PSSession*exchange*",
        "*New-PSSession*outlook.office365.com*"
      ) or
      (
        process.command_line : "*ldap*" and
        process.command_line : ("*proxyaddresses*", "*targetaddress*", "*msexch*")
      )
    )
  ) or
  (
    event.category == "file" and
    file.path : ("*.pst", "*.ost") and
    not process.name : (
      "outlook.exe",
      "svchost.exe",
      "services.exe",
      "msedge.exe",
      "microsoftedge.exe",
      "MsMpEng.exe"
    )
  )

high severity high confidence

Data Sources

Elastic Endpoint Security agent (Windows process events) Windows Sysmon via Elastic Agent or Winlogbeat Windows Security Event Log via Winlogbeat (EventID 4688 with command-line auditing enabled)

Required Tables

logs-endpoint.events.process-* logs-endpoint.events.file-* winlogbeat-* (with process.command_line populated via EventID 4688) .ds-logs-endpoint.events.process-*

False Positives

Exchange administrators legitimately running Get-Mailbox, Get-Recipient, or Get-GlobalAddressList cmdlets for mailbox reporting, compliance exports, GAL synchronisation, or address book maintenance tasks as part of approved IT operations
Email migration tools such as BitTitan MigrationWiz, Quest Migration Manager, or Microsoft-native IMAP migration scripts that enumerate address lists and access PST/OST files during planned migration windows
Enterprise email backup and archiving software (Veritas Enterprise Vault, Commvault, AvePoint, Veeam Backup for Microsoft 365) accessing PST or OST files during scheduled archive or backup jobs
IT provisioning automation scripts using Exchange PowerShell cmdlets (Get-MailUser, Get-Recipient) to validate email routing or automate user onboarding and offboarding workflows via ITSM integrations
Authorized red team or penetration testing engagements using MailSniper or Ruler under documented scope agreements

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  sourceip AS source_ip,
  username,
  QIDNAME(qid) AS event_name,
  "Process CommandLine" AS command_line,
  "Parent CommandLine" AS parent_command_line,
  "Process Image" AS process_image,
  LOGSOURCENAME(logsourceid) AS log_source,
  CATEGORYNAME(category) AS category_name
FROM events
WHERE
  LOGSOURCETYPEID IN (12, 311, 357)
  AND "EventID" IN ('1', '4688')
  AND (
    LOWER("Process CommandLine") LIKE '%get-globaladdresslist%'
    OR LOWER("Process CommandLine") LIKE '%get-addresslist%'
    OR LOWER("Process CommandLine") LIKE '%get-offlineaddressbook%'
    OR LOWER("Process CommandLine") LIKE '%get-recipient%'
    OR LOWER("Process CommandLine") LIKE '%get-mailuser%'
    OR LOWER("Process CommandLine") LIKE '%get-mailbox%'
    OR LOWER("Process CommandLine") LIKE '%mailsniper%'
    OR LOWER("Process CommandLine") LIKE '%invoke-globalo365passwordspray%'
    OR LOWER("Process CommandLine") LIKE '%invoke-selfsearch%'
    OR LOWER("Process CommandLine") LIKE '%invoke-passwordsprayowa%'
    OR LOWER("Process CommandLine") LIKE '%invoke-passwordsprayews%'
    OR LOWER("Process CommandLine") LIKE '%connect-exchangeonline%'
    OR LOWER("Process CommandLine") LIKE '%exchangemanagementshell%'
    OR LOWER("Process CommandLine") LIKE '%outlook.office365.com%'
    OR (
      LOWER("Process CommandLine") LIKE '%ruler%'
      AND (
        LOWER("Process CommandLine") LIKE '%gal%'
        OR LOWER("Process CommandLine") LIKE '%dump%'
        OR LOWER("Process CommandLine") LIKE '%enum%'
        OR LOWER("Process CommandLine") LIKE '%brute%'
      )
    )
    OR (
      LOWER("Process CommandLine") LIKE '%ldap%'
      AND (
        LOWER("Process CommandLine") LIKE '%proxyaddresses%'
        OR LOWER("Process CommandLine") LIKE '%targetaddress%'
        OR LOWER("Process CommandLine") LIKE '%msexch%'
      )
    )
  )
  AND LAST 24 HOURS
ORDER BY devicetime DESC

high severity medium confidence

Data Sources

Microsoft Windows Security Event Log (LOGSOURCETYPEID 12) with process creation auditing enabled Microsoft Sysmon forwarded to QRadar (LOGSOURCETYPEID 311, EventID 1) Microsoft Windows Event Log generic (LOGSOURCETYPEID 357)

Required Tables

events (QRadar normalized event store) Custom QRadar DSM property: 'Process CommandLine' extracted from EventID 4688 field 'Process Command Line' or Sysmon field 'CommandLine' Custom QRadar DSM property: 'Parent CommandLine' extracted from Sysmon ParentCommandLine field Custom QRadar DSM property: 'Process Image' extracted from EventID 4688 New_Process_Name or Sysmon Image field

False Positives

Exchange administrators running scheduled PowerShell scripts for GAL exports, mailbox reporting, distribution list management, or compliance-driven address book audits that are part of documented IT change requests
Automated provisioning systems (ServiceNow, SailPoint, Saviynt, Active Roles) that invoke Exchange PowerShell cmdlets as part of joiner-mover-leaver identity lifecycle workflows triggered at onboarding or offboarding
Email archiving and eDiscovery compliance tools using Exchange Web Services or PowerShell to query mailboxes and address lists for legal hold or GDPR-driven data export requests
Help desk automation that calls Get-MailUser or Get-Recipient to resolve email routing issues or verify mailbox existence during ticket handling

Sumo Logic CSE

sql

(_sourceCategory="*Windows*Sysmon*" OR _sourceCategory="*Windows*Security*")
| where EventCode = "1" OR EventCode = "4688"
| toLowerCase(CommandLine) as cmd_lower
| where cmd_lower matches "*get-globaladdresslist*"
   OR cmd_lower matches "*get-addresslist*"
   OR cmd_lower matches "*get-offlineaddressbook*"
   OR cmd_lower matches "*get-recipient*"
   OR cmd_lower matches "*get-mailuser*"
   OR cmd_lower matches "*get-mailbox*"
   OR cmd_lower matches "*mailsniper*"
   OR cmd_lower matches "*invoke-globalo365passwordspray*"
   OR cmd_lower matches "*invoke-selfsearch*"
   OR cmd_lower matches "*invoke-passwordsprayowa*"
   OR cmd_lower matches "*invoke-passwordsprayews*"
   OR cmd_lower matches "*connect-exchangeonline*"
   OR cmd_lower matches "*exchangemanagementshell*"
   OR cmd_lower matches "*outlook.office365.com*"
   OR (cmd_lower matches "*ruler*" AND (cmd_lower matches "*gal*" OR cmd_lower matches "*dump*" OR cmd_lower matches "*enum*" OR cmd_lower matches "*brute*"))
   OR (cmd_lower matches "*ldap*" AND (cmd_lower matches "*proxyaddresses*" OR cmd_lower matches "*targetaddress*" OR cmd_lower matches "*msexch*"))
| if(cmd_lower matches "*get-globaladdresslist*" OR cmd_lower matches "*get-addresslist*" OR cmd_lower matches "*get-offlineaddressbook*" OR cmd_lower matches "*get-recipient*" OR cmd_lower matches "*get-mailuser*" OR cmd_lower matches "*get-mailbox*", "YES", "NO") as GAL_Cmdlet
| if(cmd_lower matches "*mailsniper*" OR cmd_lower matches "*invoke-globalo365passwordspray*" OR cmd_lower matches "*invoke-selfsearch*" OR cmd_lower matches "*invoke-passwordsprayowa*" OR cmd_lower matches "*invoke-passwordsprayews*", "YES", "NO") as MailSniper
| if(cmd_lower matches "*connect-exchangeonline*" OR cmd_lower matches "*exchangemanagementshell*" OR cmd_lower matches "*outlook.office365.com*", "YES", "NO") as Exchange_Remote
| if(cmd_lower matches "*ruler*" AND (cmd_lower matches "*gal*" OR cmd_lower matches "*dump*" OR cmd_lower matches "*enum*"), "YES", "NO") as Ruler_Tool
| if(cmd_lower matches "*ldap*" AND (cmd_lower matches "*proxyaddresses*" OR cmd_lower matches "*targetaddress*" OR cmd_lower matches "*msexch*"), "YES", "NO") as LDAP_Email
| fields _time, Computer, User, Image, CommandLine, ParentImage, ParentCommandLine, GAL_Cmdlet, MailSniper, Exchange_Remote, Ruler_Tool, LDAP_Email
| sort by _time desc

high severity high confidence

Data Sources

Windows Sysmon logs collected via Sumo Logic Installed Collector (EventCode 1 — Process Create) Windows Security Event Log collected via Sumo Logic Installed Collector (EventCode 4688 with command-line auditing enabled)

Required Tables

_sourceCategory matching Windows Sysmon data (adjust glob to match deployment naming convention) _sourceCategory matching Windows Security Event Log data Fields required: EventCode, CommandLine, Image, ParentImage, ParentCommandLine, Computer, User

False Positives

Exchange Online administrators executing scheduled Get-Mailbox, Get-GlobalAddressList, or Get-Recipient scripts for address book maintenance, license auditing, or compliance reporting under change management approval
Third-party identity governance platforms (SailPoint IdentityNow, Varonis DatAdvantage, Okta Workflows) that invoke Exchange PowerShell cmdlets as part of access review campaigns or entitlement certifications
IT helpdesk PowerShell runbooks that call Get-Recipient or Get-MailUser to validate email address existence or routing during ticket resolution workflows
Authorised penetration testing or red team exercises using MailSniper or Ruler under documented scope with known source host ranges

Google Chronicle / SecOps

yaral

rule t1087_003_email_account_enumeration {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1087.003 Email Account enumeration via PowerShell GAL cmdlets, MailSniper toolkit, Exchange Online remote session establishment, Ruler tool GAL dumping, and LDAP queries targeting Exchange email attributes"
    mitre_attack_tactic = "Discovery"
    mitre_attack_technique = "T1087.003"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1087/003/"
    severity = "HIGH"
    confidence = "HIGH"
    created = "2026-04-13"
    platform = "Windows"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.target.process.file.full_path = /(?i)(powershell|pwsh)\.exe/
    (
      $e.target.process.command_line = /(?i)(get-globaladdresslist|get-addresslist|get-offlineaddressbook|get-recipient|get-mailuser|get-mailbox)/
      or
      $e.target.process.command_line = /(?i)(mailsniper|invoke-globalo365passwordspray|invoke-selfsearch|invoke-passwordsprayowa|invoke-passwordsprayews)/
      or
      $e.target.process.command_line = /(?i)(connect-exchangeonline|exchangemanagementshell|outlook\.office365\.com)/
      or
      $e.target.process.command_line = /(?i)ruler.{0,30}(gal|dump|enum|brute)/
      or
      (
        $e.target.process.command_line = /(?i)ldap/
        and
        $e.target.process.command_line = /(?i)(proxyaddresses|targetaddress|msexch)/
      )
    )

  condition:
    $e
}

high severity high confidence

Data Sources

Google Chronicle UDM ingestion from Windows Sysmon (via forwarder) Google Chronicle UDM ingestion from CrowdStrike Falcon (native integration) Google Chronicle UDM ingestion from Microsoft Defender for Endpoint (native integration) Google Chronicle UDM ingestion from Windows Security Event Log (via Google Cloud Chronicle forwarder or Bindplane)

Required Tables

UDM events with metadata.event_type = PROCESS_LAUNCH target.process.file.full_path (spawned process image full path) target.process.command_line (full command line of spawned process) principal.hostname (source workstation or server hostname) principal.user.userid (account executing the process)

False Positives

Exchange administrators running Get-GlobalAddressList, Get-Mailbox, or Get-Recipient interactively or via scheduled task for legitimate mailbox management, GAL synchronisation, or compliance-driven address book exports that are part of approved change management
IT automation platforms (Ansible, Puppet, PowerShell DSC, Microsoft Endpoint Manager) executing Exchange management tasks via PowerShell as part of configuration management pipelines for user provisioning, group membership, or licence assignment
Authorised email migration projects (Microsoft FastTrack, BitTitan, Quest) where engineering teams use Exchange PowerShell to enumerate mailboxes and build migration batches as part of a tenant-to-tenant or on-premises-to-cloud migration
Security tooling or SIEM connectors using Exchange PowerShell to collect audit telemetry, DLP policy data, or mailbox access logs from Exchange Online as part of security monitoring integrations

CrowdStrike LogScale (CQL)

cql

#event_simpleName=ProcessRollup2
| FileName=/(?i)(powershell|pwsh)\.exe/
| CommandLine=/(?i)(get-globaladdresslist|get-addresslist|get-offlineaddressbook|get-recipient|get-mailuser|get-mailbox|mailsniper|invoke-globalo365passwordspray|invoke-selfsearch|invoke-passwordsprayowa|invoke-passwordsprayews|connect-exchangeonline|exchangemanagementshell|outlook\.office365\.com|ruler.{0,30}(?:gal|dump|enum|brute)|ldap.{0,200}(?:proxyaddresses|targetaddress|msexch))/
| case {
    CommandLine=/(?i)(get-globaladdresslist|get-addresslist|get-offlineaddressbook|get-recipient|get-mailuser|get-mailbox)/ |
      DetectionCategory := "GAL_Cmdlet" ;
    CommandLine=/(?i)(mailsniper|invoke-globalo365passwordspray|invoke-selfsearch|invoke-passwordsprayowa|invoke-passwordsprayews)/ |
      DetectionCategory := "MailSniper" ;
    CommandLine=/(?i)(connect-exchangeonline|exchangemanagementshell|outlook\.office365\.com)/ |
      DetectionCategory := "Exchange_Remote" ;
    CommandLine=/(?i)ruler.{0,30}(?:gal|dump|enum|brute)/ |
      DetectionCategory := "Ruler_Tool" ;
    CommandLine=/(?i)ldap.{0,200}(?:proxyaddresses|targetaddress|msexch)/ |
      DetectionCategory := "LDAP_Email" ;
    * | DetectionCategory := "Multiple_Match"
  }
| table(
    [timestamp, ComputerName, UserName, FileName, CommandLine,
     ParentBaseFileName, ParentCommandLine, DetectionCategory,
     TargetProcessId, ContextProcessId]
  )
| sort(timestamp, order=desc)

high severity high confidence

Data Sources

CrowdStrike Falcon EDR sensor (Windows endpoint) Falcon LogScale (formerly Humio) as the query engine CrowdStrike ProcessRollup2 telemetry stream (full process command-line capture must be enabled in sensor policy)

Required Tables

ProcessRollup2 events (#event_simpleName=ProcessRollup2) Fields: FileName (process image name), CommandLine (full command line), ComputerName, UserName, ParentBaseFileName, ParentCommandLine, TargetProcessId, ContextProcessId

False Positives

Exchange Online administrators using the ExchangeOnlineManagement PowerShell module from authorised management workstations for routine operations such as bulk mailbox moves, distribution list audits, or GAL rebuilds — particularly common during M365 tenant migrations or consolidations
IT service desk PowerShell runbooks that invoke Get-MailUser or Get-Recipient to validate email existence or resolve delivery failures as part of automated ticketing system integrations (ServiceNow, Jira Service Management)
Third-party Microsoft 365 management tools (CodeTwo, SkyKick, Veeam Backup for M365, Barracuda) that authenticate via Exchange Online PowerShell to perform backup, policy enforcement, or archiving tasks on scheduled intervals
Developer or DevOps engineers running Exchange cmdlets on developer workstations as part of integration testing, CI/CD pipeline smoke tests, or local debugging of Exchange-integrated applications

Last updated: 2026-04-13 Research depth: deep

References (12)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1087.003 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Email Account

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Same Tactic: Discovery

Popular Detections