Gather Victim Identity Information: Employee Names (T1589.003)

Tactic: Reconnaissance · Platforms: PRE

The interactive view maps 1 detection strategy, 1 mitigation, 3 threat groups to this technique, alongside D3FEND countermeasures and data-component coverage.

Sub-technique of Gather Victim Identity Information (T1589).

Overview

Adversaries may gather employee names that can be used during targeting. Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures.

Adversaries may easily gather employee names, since they may be readily available and exposed via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).

Explore

• Open T1589.003 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1589.003
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan