AN0641
Analytic 0641
Windows
Enumeration of global address lists or email account metadata via PowerShell cmdlets (e.g., Get-GlobalAddressList) or MAPI/RPC from non-admin, non-mailserver systems.
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
WinEventLog:Sysmon
EventCode=1
[CommandLinePattern]
Match variations of Get-GlobalAddressList, Get-Recipient, and related cmdlets.
[HostRole]
Suppress expected usage on Exchange servers or known IT admin consoles.
[TimeWindow]
Detect bulk execution patterns in short intervals, often used during recon.
AN0642
Analytic 0642
Office Suite
Suspicious querying of organization-wide directory data via Google Workspace Directory API or Outlook GAL sync in high volume from abnormal users, service accounts, or unknown device contexts.
gcp:audit
Directory API Access: users.list or groups.list
m365:unified
GAL Lookup or Address Book download
azure:signinlogs
Unusual Token Usage or Application Consent
[APIQueryVolume]
Set thresholds for excessive use of 'users.list' or recursive group enumerations.
[UserContext]
Flag non-admin or previously unseen user agents requesting directory information.
[AppSource]
Distinguish between sanctioned sync tools and unauthorized scripts or OAuth tokens.