{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1586","id":"T1586","name":"Compromise Accounts","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1586","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"1625b9a618d6b3084db6631c2f2a6672d706f748817ea221b175521ee781471e","description":"Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. [Establish Accounts](https://attack.mitre.org/techniques/T1585)), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. \n\nA variety of methods exist for compromising accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials.(Citation: AnonHBGary)(Citation: Microsoft DEV-0537) Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation.\n\nPersonas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos.\n\nAdversaries may directly leverage compromised email accounts for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1586","external_id":"T1586"},{"source_name":"AnonHBGary","description":"Bright, P. (2011, February 15). Anonymous speaks: the inside story of the HBGary hack. Retrieved March 9, 2017.","url":"https://arstechnica.com/tech-policy/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack/"},{"source_name":"Microsoft DEV-0537","description":"Microsoft. (2022, March 22). DEV-0537 criminal actor targeting organizations for data exfiltration and destruction. Retrieved March 23, 2022.","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}],"platforms":["PRE"],"environments":["external-services"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1586.001","id":"T1586.001","name":"Social Media Accounts","page":"techniques/enterprise/T1586.001/"},{"key":"enterprise/T1586.002","id":"T1586.002","name":"Email Accounts","page":"techniques/enterprise/T1586.002/"},{"key":"enterprise/T1586.003","id":"T1586.003","name":"Cloud Accounts","page":"techniques/enterprise/T1586.003/"}],"telemetry":[{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0052","name":"Social Media","page":"telemetry/DC0052/","kind":"attack_component","category":"External context and intelligence","description":"Public or lawfully obtained social-platform content used as investigative context.","collection_focus":"Use platform-permitted collection; retain permalink, publication/retrieval times and provenance without collecting private accounts or credentials.","providers":[{"name":"Platform-permitted public-content exports","scope":"Public profiles/posts with provenance; availability depends on platform terms and access.","source_id":"stix"},{"name":"Analyst-curated STIX repositories","scope":"Structured contextual observations with source and confidence, not privileged platform audit logs.","source_id":"stix"}],"configuration":["Define an approved public-content scope and the platform-permitted retrieval method. Do not access private accounts or bypass access controls.","Retain publication time, collection time, source URL, account identifier and exact evidence provenance; redact unnecessary personal information.","Record analyst confidence and alternative explanations. Keep acquired-account claims separate from evidence that the account was used in a specific intrusion."],"configuration_example":null,"required_fields":["post_url","observed_at","content_summary","confidence"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0052","collector":"illustrative-lab-collector","observation":{"post_url":"https://example.test/posts/lab-1","observed_at":"2026-09-27T12:00:00Z","content_summary":"Fictional lab hiring notice","confidence":"context_only"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A public profile or post is context, not proof of operator identity, account compromise or victim access. The STIX reference describes representation, not a platform API entitlement.","sources":[{"id":"stix","title":"OASIS STIX 2.1 specification","url":"https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html"}],"association":"attack_component","anomaly_design":"Changes in external infrastructure, registration or published intelligence can supply context. They do not expose private attacker actions or establish a victim-side detector; preserve timestamps and attribution uncertainty."}],"detection":{"key":"enterprise/T1586","id":"T1586","name":"Compromise Accounts","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"source_url":"https://attack.mitre.org/techniques/T1586","technique_page":"techniques/enterprise/T1586/","page":"detections/enterprise/T1586/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[{"id":"7215374a-de4f-4b33-8ba5-70804c9251d3","title":"Bitbucket Unauthorized Access To A Resource","status":"test","level":"critical","logsource":{"product":"bitbucket","service":"audit","definition":"Requirements: \"Advance\" log level is required to receive these audit events."},"data_path":"data/detection-rules/7215374a-de4f-4b33-8ba5-70804c9251d3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/bitbucket/audit/bitbucket_audit_unauthorized_access_detected.yml","author":"Muhammad Faisal (@faisalusuf)","kind":"sigma"},{"id":"34d81081-03c9-4a7f-91c9-5e46af625cde","title":"Bitbucket Unauthorized Full Data Export Triggered","status":"test","level":"critical","logsource":{"product":"bitbucket","service":"audit","definition":"Requirements: \"Advance\" log level is required to receive these audit events."},"data_path":"data/detection-rules/34d81081-03c9-4a7f-91c9-5e46af625cde.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/bitbucket/audit/bitbucket_audit_unauthorized_full_data_export_triggered.yml","author":"Muhammad Faisal (@faisalusuf)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0876","name":"Detection of Compromise Accounts","url":"https://attack.mitre.org/detectionstrategies/DET0876","stix_id":"x-mitre-detection-strategy--a1d413d7-0a28-45ce-9e4d-d250b4b6a492","relationship_id":"relationship--addbc146-e378-4ca0-aca1-8de5443af453","description":"","analytics":[{"id":"AN2008","name":"Analytic 2008","guidance":"Consider monitoring social media activity related to your organization. Suspicious activity may include personas claiming to work for your organization or recently modified accounts making numerous connection requests to accounts affiliated with your organization.\nMuch of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: Phishing).\nMonitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).","url":"https://attack.mitre.org/detectionstrategies/DET0876#AN2008","platforms":["PRE"],"tuning":[],"log_sources":[{"component_id":"DC0052","component":"Social Media","name":"Persona","channel":"None","platforms":["PRE"],"analytic_id":"AN2008","source_url":"https://attack.mitre.org/detectionstrategies/DET0876#AN2008","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0052/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"Network Traffic","channel":"None","platforms":["PRE"],"analytic_id":"AN2008","source_url":"https://attack.mitre.org/detectionstrategies/DET0876#AN2008","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]}]}],"telemetry_references":[{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0052","name":"Social Media","tag":"Social Media","page":"telemetry/DC0052/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[],"mitigations":[{"id":"M1056","name":"Pre-compromise","url":"https://attack.mitre.org/mitigations/M1056","kind":"course-of-action","description":"This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.","relationship_id":"relationship--d06c7363-a7f6-43b1-8af8-9d3b9975160c","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1585":"/ttp-simulation/techniques/enterprise/T1585/","T1598":"/ttp-simulation/techniques/enterprise/T1598/","T1566":"/ttp-simulation/techniques/enterprise/T1566/","T1586":"/ttp-simulation/techniques/enterprise/T1586/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1586","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0052","collector":"illustrative-lab-collector","observation":{"post_url":"https://example.test/posts/lab-1","observed_at":"2026-09-27T12:00:00Z","content_summary":"Fictional lab hiring notice","confidence":"context_only"}}]}}