Compromise Accounts

T1586

Technique with 3 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. Establish Accounts), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona.

A variety of methods exist for compromising accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials. Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation.

Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos.

Adversaries may directly leverage compromised email accounts for Phishing for Information or Phishing.

Detection rules39

Rules on DetectionCode tagged with T1586 or one of its sub-techniques.

Sigma3

Rule	Level	Log source	Technique
Bitbucket Unauthorized Access To A Resource	critical	bitbucket / NULL	T1586
Bitbucket Unauthorized Full Data Export Triggered	critical	bitbucket / NULL	T1586
Okta Suspicious Activity Reported by End-user	high	okta / NULL	T1586.003

Splunk36

Rule	Type	Risk	Data source	Technique
ASL AWS Credential Access GetPasswordData	Anomaly	NULL	ASL AWS CloudTrail	T1586.003
ASL AWS Credential Access RDS Password reset	TTP	NULL	ASL AWS CloudTrail	T1586.003
ASL AWS Multi-Factor Authentication Disabled	TTP	NULL	ASL AWS CloudTrail	T1586.003
AWS Console Login Failed During MFA Challenge	TTP	NULL	AWS CloudTrail ConsoleLogin	T1586.003
AWS Credential Access Failed Login	TTP	NULL	AWS CloudTrail ConsoleLogin	T1586.003
AWS Credential Access GetPasswordData	Anomaly	NULL	AWS CloudTrail GetPasswordData	T1586.003
AWS Credential Access RDS Password reset	TTP	NULL	AWS CloudTrail ModifyDBInstance	T1586.003
AWS Multi-Factor Authentication Disabled	TTP	NULL	AWS CloudTrail DeleteVirtualMFADevice, AWS CloudTrail DeactivateMFADevice	T1586.003
AWS Multiple Failed MFA Requests For User	Anomaly	NULL	AWS CloudTrail ConsoleLogin	T1586.003
AWS Successful Console Authentication From Multiple IPs	Anomaly	NULL	AWS CloudTrail ConsoleLogin	T1586
AWS Successful Single-Factor Authentication	TTP	NULL	AWS CloudTrail ConsoleLogin	T1586.003
AWS Unusual Number of Failed Authentications From Ip	Anomaly	NULL	AWS CloudTrail ConsoleLogin	T1586.003
Azure Active Directory High Risk Sign-in	TTP	NULL	Azure Active Directory	T1586.003
Azure AD Authentication Failed During MFA Challenge	TTP	NULL	Azure Active Directory	T1586.003
Azure AD Multi-Factor Authentication Disabled	TTP	NULL	Azure Active Directory Disable Strong Authentication	T1586.003
Azure AD Multi-Source Failed Authentications Spike	Hunting	NULL	Azure Active Directory	T1586.003
Azure AD Multiple Failed MFA Requests For User	TTP	NULL	Azure Active Directory Sign-in activity	T1586.003
Azure AD Multiple Users Failing To Authenticate From Ip	Anomaly	NULL	Azure Active Directory	T1586.003
Azure AD Successful PowerShell Authentication	TTP	NULL	Azure Active Directory	T1586.003
Azure AD Successful Single-Factor Authentication	TTP	NULL	Azure Active Directory	T1586.003
Azure AD Unusual Number of Failed Authentications From Ip	Anomaly	NULL	Azure Active Directory	T1586.003
Detect AWS Console Login by New User	Hunting	NULL	AWS CloudTrail	T1586.003
Detect AWS Console Login by User from New City	Hunting	NULL	AWS CloudTrail	T1586.003
Detect AWS Console Login by User from New Country	Hunting	NULL	AWS CloudTrail	T1586.003
Detect AWS Console Login by User from New Region	Hunting	NULL	AWS CloudTrail	T1586.003
GCP Authentication Failed During MFA Challenge	TTP	NULL	Google Workspace login_failure	T1586.003
GCP Multi-Factor Authentication Disabled	TTP	NULL	Google Workspace	T1586.003
GCP Multiple Failed MFA Requests For User	TTP	NULL	Google Workspace	T1586.003
GCP Multiple Users Failing To Authenticate From Ip	Anomaly	NULL	Google Workspace	T1586.003
GCP Successful Single-Factor Authentication	TTP	NULL	Google Workspace	T1586.003
GCP Unusual Number of Failed Authentications From Ip	Anomaly	NULL	Google Workspace	T1586.003
O365 Multi-Source Failed Authentications Spike	Hunting	NULL	O365 UserLoginFailed	T1586.003
O365 Multiple Users Failing To Authenticate From Ip	TTP	NULL	O365 UserLoginFailed	T1586.003
Okta Authentication Failed During MFA Challenge	TTP	NULL	Okta	T1586.003
Okta Successful Single Factor Authentication	Anomaly	NULL	Okta	T1586.003
Okta User Logins from Multiple Cities	Anomaly	NULL	Okta	T1586.003

Sub-techniques3

ID	Name	Examples
T1586.001	Social Media Accounts	2
T1586.002	Email Accounts	16
T1586.003	Cloud Accounts	3

Groups0

None recorded.

Software0

None recorded.

Campaigns0

None recorded.

Procedure examples0

No procedure examples are recorded for this technique.

References2

AnonHBGary Open source
Bright, P. (2011, February 15). Anonymous speaks: the inside story of the HBGary hack. Retrieved March 9, 2017.
Microsoft DEV-0537 Open source
Microsoft. (2022, March 22). DEV-0537 criminal actor targeting organizations for data exfiltration and destruction. Retrieved March 23, 2022.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.