Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1589.002_email-addresses
Adversaries may gather email addresses that can be used during targeting.
Passed 16 of 22 test cases with the skill, and 12 of 22 without it.
and 3 more in the full report
4 fixed12 passed either way6 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
How many known mitigations and detection strategies are identified in the evaluation framework for sub-technique T1589.002?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies exactly 1 known mitigation. | Missed | Passed |
| Identifies exactly 1 detection strategy. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1589
Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees.
Adversaries may easily gather email addresses, since they may be readily available and exposed via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Email addresses could also be enumerated via more active means (i.e. Active Scanning), such as probing and analyzing responses from authentication services that may reveal valid usernames in a system. For example, adversaries may be able to enumerate email addresses in Office 365 environments by querying a variety of publicly available API endpoints, such as autodiscover and GetCredentialType.
Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Email Accounts), and/or initial access (ex: Phishing or Brute Force via External Remote Services).
Platforms: PRE
Identify Attack Surface: Determine if the target environment is susceptible to Email Addresses by examining the target platforms (PRE).
Assess Existing Defenses: Review whether mitigations for T1589.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 12 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.