Establish Accounts T1585

Tactic: Resource Development

Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.

Authoring guide

These 2 rules share fields, values, and exclusions.

Fields filtered most (5 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
AADOperationType1eq 1Add
DomainAdded1contains 1onmicrosoft
OperationName1in 1Add unverified domain, Add verified domain
Result1eq 1success
event1eq 1saml.created

Top indicator values (6 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
AADOperationTypeeq
Add
1
DomainAddedcontains
onmicrosoft
1
OperationNamein
Add unverified domain
1
OperationNamein
Add verified domain
1
Resulteq
success
131
eventeq
saml.created
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Kusto 1 rule

Panther 1 rule