value:  TrickBot collects email addresses from Outlook.;;Threat actors will often attempt to gather more targets by using tools that lists of users from memory, and combine this with a company’s email naming convention to create a target list of email addresses. ;; Some actors use open-source malware and tools to target and steal email account credentials from popular email clients such as, Apple Mail, Gmail, and Outlook. ;; Spearphising is used by the most advanced threat groups in the world, which shows the potential value that skilled threat actors can extract by discovering which email addresses to target. ;; Malware can used by actors to automate email account discovery. ;; Actors can exploit vulnerabilities, such as Log4Shell, to move into different directories to quickly locate email addresses. 
name: Account Discovery: Email Account