{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1585","id":"T1585","name":"Establish Accounts","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1585","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"223b4a77dfe516af1ad1bf91b300ffcac763d0f34d7d5087879e8c2a7d226e50","description":"Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)\n\nFor operations incorporating social engineering, the utilization of an online persona may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, GitHub, Docker Hub, etc.). Establishing a persona may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)\n\nEstablishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) In addition, establishing accounts may allow adversaries to abuse free services, such as registering for trial periods to [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) for malicious purposes.(Citation: Free Trial PurpleUrchin)\n","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1585","external_id":"T1585"},{"source_name":"Free Trial PurpleUrchin","description":"Gamazo, William. Quist, Nathaniel.. (2023, January 5). PurpleUrchin Bypasses CAPTCHA and Steals Cloud Platform Resources. Retrieved February 28, 2024.","url":"https://unit42.paloaltonetworks.com/purpleurchin-steals-cloud-resources/"},{"source_name":"NEWSCASTER2014","description":"Lennon, M. (2014, May 29). Iranian Hackers Targeted US Officials in Elaborate Social Media Attack Operation. Retrieved March 1, 2017.","url":"https://www.securityweek.com/iranian-hackers-targeted-us-officials-elaborate-social-media-attack-operation"},{"source_name":"Mandiant APT1","description":"Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"},{"source_name":"BlackHatRobinSage","description":"Ryan, T. (2010). “Getting In Bed with Robin Sage.”. Retrieved March 6, 2017.","url":"http://media.blackhat.com/bh-us-10/whitepapers/Ryan/BlackHat-USA-2010-Ryan-Getting-In-Bed-With-Robin-Sage-v1.0.pdf"}],"platforms":["PRE"],"environments":["external-services"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1585.001","id":"T1585.001","name":"Social Media Accounts","page":"techniques/enterprise/T1585.001/"},{"key":"enterprise/T1585.002","id":"T1585.002","name":"Email Accounts","page":"techniques/enterprise/T1585.002/"},{"key":"enterprise/T1585.003","id":"T1585.003","name":"Cloud Accounts","page":"techniques/enterprise/T1585.003/"}],"telemetry":[{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0052","name":"Social Media","page":"telemetry/DC0052/","kind":"attack_component","category":"External context and intelligence","description":"Public or lawfully obtained social-platform content used as investigative context.","collection_focus":"Use platform-permitted collection; retain permalink, publication/retrieval times and provenance without collecting private accounts or credentials.","providers":[{"name":"Platform-permitted public-content exports","scope":"Public profiles/posts with provenance; availability depends on platform terms and access.","source_id":"stix"},{"name":"Analyst-curated STIX repositories","scope":"Structured contextual observations with source and confidence, not privileged platform audit logs.","source_id":"stix"}],"configuration":["Define an approved public-content scope and the platform-permitted retrieval method. Do not access private accounts or bypass access controls.","Retain publication time, collection time, source URL, account identifier and exact evidence provenance; redact unnecessary personal information.","Record analyst confidence and alternative explanations. Keep acquired-account claims separate from evidence that the account was used in a specific intrusion."],"configuration_example":null,"required_fields":["post_url","observed_at","content_summary","confidence"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0052","collector":"illustrative-lab-collector","observation":{"post_url":"https://example.test/posts/lab-1","observed_at":"2026-09-27T12:00:00Z","content_summary":"Fictional lab hiring notice","confidence":"context_only"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A public profile or post is context, not proof of operator identity, account compromise or victim access. The STIX reference describes representation, not a platform API entitlement.","sources":[{"id":"stix","title":"OASIS STIX 2.1 specification","url":"https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html"}],"association":"attack_component","anomaly_design":"Changes in external infrastructure, registration or published intelligence can supply context. They do not expose private attacker actions or establish a victim-side detector; preserve timestamps and attribution uncertainty."}],"detection":{"key":"enterprise/T1585","id":"T1585","name":"Establish Accounts","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"source_url":"https://attack.mitre.org/techniques/T1585","technique_page":"techniques/enterprise/T1585/","page":"detections/enterprise/T1585/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0873","name":"Detection of Establish Accounts","url":"https://attack.mitre.org/detectionstrategies/DET0873","stix_id":"x-mitre-detection-strategy--095e0e71-498f-4403-a69f-5a6e4ff50503","relationship_id":"relationship--0c4c2d92-3e46-420b-aec9-addb022a5deb","description":"","analytics":[{"id":"AN2005","name":"Analytic 2005","guidance":"Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).\nConsider monitoring social media activity related to your organization. Suspicious activity may include personas claiming to work for your organization or recently created/modified accounts making numerous connection requests to accounts affiliated with your organization.\nMuch of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: Phishing).","url":"https://attack.mitre.org/detectionstrategies/DET0873#AN2005","platforms":["PRE"],"tuning":[],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"Network Traffic","channel":"None","platforms":["PRE"],"analytic_id":"AN2005","source_url":"https://attack.mitre.org/detectionstrategies/DET0873#AN2005","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0052","component":"Social Media","name":"Persona","channel":"None","platforms":["PRE"],"analytic_id":"AN2005","source_url":"https://attack.mitre.org/detectionstrategies/DET0873#AN2005","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0052/"}]}]}],"telemetry_references":[{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0052","name":"Social Media","tag":"Social Media","page":"telemetry/DC0052/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[{"id":"G0025","name":"APT17","url":"https://attack.mitre.org/groups/G0025","kind":"intrusion-set","description":"[APT17](https://attack.mitre.org/groups/G0025) has created and cultivated profile pages in Microsoft TechNet. To make profile pages appear more legitimate, [APT17](https://attack.mitre.org/groups/G0025) has created biographical sections and posted in forum threads.(Citation: FireEye APT17)","relationship_id":"relationship--fd9834dc-0323-408b-b217-3f3aa27b50ac","references":[{"source_name":"FireEye APT17","description":"FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20240119213200/https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has leveraged stolen PII to create accounts.(Citation: Mandiant APT43 March 2024)","relationship_id":"relationship--47754b4e-4da2-41b2-bbe6-e9a7a1025884","references":[{"source_name":"Mandiant APT43 March 2024","description":"Mandiant. (2024, March 14). APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations. Retrieved May 3, 2024.","url":"https://services.google.com/fh/files/misc/apt43-report-en.pdf"}]},{"id":"G0117","name":"Fox Kitten","url":"https://attack.mitre.org/groups/G0117","kind":"intrusion-set","description":"[Fox Kitten](https://attack.mitre.org/groups/G0117) has created KeyBase accounts to communicate with ransomware victims.(Citation: ClearSky Pay2Kitten December 2020)(Citation: Check Point Pay2Key November 2020)","relationship_id":"relationship--340a62c8-9f22-4cb6-9310-bd4136e14258","references":[{"source_name":"ClearSky Pay2Kitten December 2020","description":"ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.","url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"},{"source_name":"Check Point Pay2Key November 2020","description":"Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021.","url":"https://research.checkpoint.com/2020/ransomware-alert-pay2key/"}]},{"id":"G1003","name":"Ember Bear","url":"https://attack.mitre.org/groups/G1003","kind":"intrusion-set","description":"[Ember Bear](https://attack.mitre.org/groups/G1003) has created accounts on dark web forums to obtain various tools and malware.(Citation: CISA GRU29155 2024)","relationship_id":"relationship--7121d134-bda1-46a1-aa6c-64609e58603c","references":[{"source_name":"CISA GRU29155 2024","description":"US Cybersecurity & Infrastructure Security Agency et al. (2024, September 5). Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Retrieved September 6, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"id":"G1052","name":"Contagious Interview","url":"https://attack.mitre.org/groups/G1052","kind":"intrusion-set","description":"[Contagious Interview](https://attack.mitre.org/groups/G1052) has created and maintained personas on code repositories to distribute malicious payloads.(Citation: Sentinel One Contagious Interview ClickFix September 2025)(Citation: Validin Contagious Interview North Korea ClickFix January 2025)(Citation: Socket Contagious Interview NPM April 2025)(Citation: Socket BeaverTail XORIndex HexEval Contagious Interview July 2025)(Citation: Socket HexEval BeaverTail Contagious Interview June 2025)(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)","relationship_id":"relationship--093ef970-4648-441d-bbc5-d8cf8ebfa7e5","references":[{"source_name":"Sentinel One Contagious Interview ClickFix September 2025","description":"Aleksandar Milenkoski, Sreekar Madabushi, Kenneth Kinion. (2025, September 4). Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms. Retrieved October 20, 2025.","url":"https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/"},{"source_name":"Validin Contagious Interview North Korea ClickFix January 2025","description":"Efstratios Lontzetidis. (2025, January 16). Lazarus APT: Techniques for Hunting Contagious Interview. Retrieved October 20, 2025.","url":"https://www.validin.com/blog/inoculating_contagious_interview_with_validin/"},{"source_name":"Socket Contagious Interview NPM April 2025","description":"Kirill Boychenko. (2025, April 4). Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads. Retrieved October 20, 2025.","url":"https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket"},{"source_name":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","description":"Kirill Boychenko. (2025, July 14). Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader. Retrieved October 19, 2025.","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"},{"source_name":"Socket HexEval BeaverTail Contagious Interview June 2025","description":"Kirill Boychenko. (2025, June 25). Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages. Retrieved October 19, 2025.","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"},{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","description":"Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025.","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"}]},{"id":"G1058","name":"The Gentlemen","url":"https://attack.mitre.org/groups/G1058","kind":"intrusion-set","description":"[The Gentlemen](https://attack.mitre.org/groups/G1058) and its affiliates have leveraged Tox to communicate with victims.(Citation: CarveyODonnellWelchHuntress_TheGentlemen_May2026)(Citation: TrendAI_TheGentlemen_Sept2025)","relationship_id":"relationship--9698ce22-f948-4ea6-bd97-bff2c29381ac","references":[{"source_name":"CarveyODonnellWelchHuntress_TheGentlemen_May2026","description":"Carvey, H., O'Donnell-Welch, L. (2026, May 21). The Gentlemen (Ransomware) in Disguise: Defense Evasion and other TTPs. Retrieved September 18, 2026.","url":"https://www.huntress.com/blog/the-gentlemen-ransomware-defense-evasion-ttps"},{"source_name":"TrendAI_TheGentlemen_Sept2025","description":"Santos, J., et al. (2025, September 9). Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed . Retrieved September 18, 2026.","url":"https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/unmasking-the-gentlemen-ransomware"}]}],"mitigations":[{"id":"M1056","name":"Pre-compromise","url":"https://attack.mitre.org/mitigations/M1056","kind":"course-of-action","description":"This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.","relationship_id":"relationship--3b09f6eb-ff5a-4d95-ae24-d4f6934a8fc6","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1598":"/ttp-simulation/techniques/enterprise/T1598/","T1566":"/ttp-simulation/techniques/enterprise/T1566/","T1583":"/ttp-simulation/techniques/enterprise/T1583/","T1585":"/ttp-simulation/techniques/enterprise/T1585/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1585","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0052","collector":"illustrative-lab-collector","observation":{"post_url":"https://example.test/posts/lab-1","observed_at":"2026-09-27T12:00:00Z","content_summary":"Fictional lab hiring notice","confidence":"context_only"}}]}}