Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees.

Adversaries may easily gather email addresses, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: HackersArise Email)(Citation: CNET Leaks) Email addresses could also be enumerated via more active means (i.e. [Active Scanning](https://attack.mitre.org/techniques/T1595)), such as probing and analyzing responses from authentication services that may reveal valid usernames in a system.(Citation: GrimBlog UsernameEnum) For example, adversaries may be able to enumerate email addresses in Office 365 environments by querying a variety of publicly available API endpoints, such as autodiscover and GetCredentialType.(Citation: GitHub Office 365 User Enumeration)(Citation: Azure Active Directory Reconnaisance)

Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Email Accounts](https://attack.mitre.org/techniques/T1586/002)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Brute Force](https://attack.mitre.org/techniques/T1110) via [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Email Addresses
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1589/002  external_id: T1589.002     source_name: Azure Active Directory Reconnaisance  description: Dr. Nestori Syynimaa. (2020, June 13). Just looking: Azure Active Directory reconnaissance as an outsider. Retrieved May 27, 2022.  url: https://o365blog.com/post/just-looking/     source_name: GitHub Office 365 User Enumeration  description: gremwell. (2020, March 24). Office 365 User Enumeration. Retrieved May 27, 2022.  url: https://github.com/gremwell/o365enum     source_name: GrimBlog UsernameEnum  description: GrimHacker. (2017, July 24). Office365 ActiveSync Username Enumeration. Retrieved December 9, 2021.  url: https://grimhacker.com/2017/07/24/office365-activesync-username-enumeration/     source_name: HackersArise Email  description: Hackers Arise. (n.d.). Email Scraping and Maltego. Retrieved October 20, 2020.  url: https://www.hackers-arise.com/email-scraping-and-maltego     source_name: CNET Leaks  description: Ng, A. (2019, January 17). Massive breach leaks 773 million email addresses, 21 million passwords. Retrieved October 20, 2020.  url: https://www.cnet.com/news/massive-breach-leaks-773-million-emails-21-million-passwords/     