Detect Email Addresses in CrowdStrike LogScale
Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees. Adversaries may gather email addresses from publicly accessible sources such as social media, company websites, and leaked credential databases. Additionally, adversaries may actively enumerate valid email addresses by probing authentication services — for example, querying the Microsoft GetCredentialType API endpoint or Exchange Autodiscover to determine whether a given address is a valid account in Office 365 or on-premises Exchange environments. Gathered email addresses enable spearphishing campaigns, credential brute force attacks, business email compromise, and social engineering operations.
MITRE ATT&CK
- Tactic
- Reconnaissance
- Technique
- T1589 Gather Victim Identity Information
- Sub-technique
- T1589.002 Email Addresses
- Canonical reference
- https://attack.mitre.org/techniques/T1589/002/
LogScale Detection Query
// Azure AD email enumeration — CrowdStrike Falcon LogScale
// Requires Azure AD sign-in logs ingested via Falcon Log Collector or LogScale SIEM Connector
#repo = "azure_ad" OR #repo = "o365"
| resultType in ["50034", "50053", "50055", "50056"]
| ipAddress != ""
| userPrincipalName != ""
| groupBy(
[ipAddress, clientAppUsed, userAgent, bucket := timeBucket(span="1h")],
function=[
count(field=userPrincipalName, distinct=true, as=UniqueUsernames),
count(as=AttemptCount),
collect([userPrincipalName], limit=25, as=UsernameSample),
collect([appDisplayName], limit=10, as=AppList),
min(@timestamp, as=FirstSeen),
max(@timestamp, as=LastSeen)
]
)
| UniqueUsernames >= 10
| DurationMs := LastSeen - FirstSeen
| DurationMinutes := if(DurationMs < 60000, 1, round(DurationMs / 60000, 1))
| EnumerationRatePerMin := round(UniqueUsernames / DurationMinutes, 2)
| case {
UniqueUsernames >= 50 | Verdict := "High Confidence Enumeration" ;
UniqueUsernames >= 20 | Verdict := "Moderate Enumeration" ;
* | Verdict := "Low-Level Enumeration"
}
| sort(UniqueUsernames, order=desc)
| select([bucket, ipAddress, clientAppUsed, userAgent, UniqueUsernames, AttemptCount, EnumerationRatePerMin, DurationMinutes, Verdict, UsernameSample, AppList])CrowdStrike Falcon LogScale (CQL) query detecting email address enumeration via Azure AD sign-in error code analysis. Requires Azure AD sign-in logs to be ingested into a LogScale repository via Falcon Log Collector or a configured SIEM connector. Filters events by resultType error codes 50034, 50053, 50055, and 50056, groups by source IP in 1-hour buckets using timeBucket(), and counts distinct probed usernames using count(distinct=true). Applies the same three-tier confidence classification as the reference KQL and SPL detections (High/Moderate/Low-Level Enumeration) with enumeration rate per minute computed for analyst triage prioritization.
Data Sources
Required Tables
False Positives & Tuning
- Microsoft Entra Connect or hybrid join configuration services generating authentication validation requests for multiple accounts from a dedicated connector server during scheduled sync windows, producing high unique-username bursts
- Authorized red team or penetration testing engagements targeting Azure AD infrastructure from external IP ranges that have not been explicitly excluded from detection thresholds prior to the exercise
- Third-party identity governance or access certification platforms performing periodic account validity sweeps across large user populations from a fixed service account IP as part of quarterly recertification campaigns
Other platforms for T1589.002
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Azure AD Email Enumeration via GetCredentialType API (PowerShell)
Expected signal: Sysmon Event ID 1: PowerShell.exe process with CommandLine containing 'GetCredentialType' and 'login.microsoftonline.com'. Sysmon Event ID 3: Outbound network connections from powershell.exe to login.microsoftonline.com (TCP 443). Proxy/web filter logs: HTTP POST to login.microsoftonline.com/common/GetCredentialType with PowerShell User-Agent. DeviceNetworkEvents in MDE: InitiatingProcessFileName=powershell.exe, RemoteUrl containing GetCredentialType.
- Test 2Azure AD Email Enumeration via AADInternals Module
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'AADInternals' and 'UserEnumerationAsOutsider'. Sysmon Event ID 3: Network connections to login.microsoftonline.com and related Microsoft AAD endpoints. PowerShell ScriptBlock Log Event ID 4104 capturing the full module invocation. Windows Security Event ID 4688: Process creation for powershell.exe with command line auditing enabled. Proxy logs: HTTP requests with AADInternals User-Agent string to Microsoft authentication endpoints.
- Test 3Email Enumeration via Sign-in Attempt with Non-Existent Accounts (Generates SigninLogs 50034)
Expected signal: Azure AD SigninLogs: 10 entries with ResultType=50034 (UserAccountNotFound) for each probed address, all from the same source IP. These entries are visible in the Azure Portal under Azure AD > Sign-in logs and in Microsoft Sentinel's SigninLogs table within 5-15 minutes. Field ClientAppUsed will show 'Other clients'.
- Test 4OSINT Email Harvesting Simulation via Python Requests (LinkedIn/Web Scraping Pattern)
Expected signal: Sysmon Event ID 1: python3.exe process creation with CommandLine containing 'theHarvester' User-Agent string. Sysmon Event ID 3: Network connections from python3.exe to target hosts over TCP 443/80. DeviceNetworkEvents in MDE: InitiatingProcessFileName=python3.exe, RemoteUrl matching target sites. Proxy logs: HTTP GET requests with theHarvester User-Agent string — this User-Agent string is well-known and often blocked/alerted by web proxies.
- Test 5Exchange Autodiscover Email Validation Probe (curl)
Expected signal: Sysmon Event ID 1: curl.exe process creation with CommandLine containing 'autodiscover' and target email addresses. Sysmon Event ID 3: Outbound network connections from curl.exe to autodiscover.targetdomain.com over TCP 443. Exchange IIS Access Logs (W3SVC): POST requests to /autodiscover/autodiscover.xml with 401 response codes, source IP, and User-Agent 'curl/*'. Windows Security Event ID 4625 (Logon Failure): if Basic Authentication is attempted against Exchange.
References (9)
- https://attack.mitre.org/techniques/T1589/002/
- https://o365blog.com/post/just-looking/
- https://github.com/gremwell/o365enum
- https://grimhacker.com/2017/07/24/office365-activesync-username-enumeration/
- https://www.hackers-arise.com/email-scraping-and-maltego
- https://www.cnet.com/news/massive-breach-leaks-773-million-emails-21-million-passwords/
- https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-sign-ins
- https://github.com/dafthack/MSOLSpray
- https://github.com/0xZDH/o365spray
Unlock Pro Content
Get the full detection package for T1589.002 including response playbook, investigation guide, and atomic red team tests.