Impersonation T1656

Tactic: Stealth

Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims. In many cases of business email compromise or email fraud campaigns, adversaries use impersonation to defraud victims -- deceiving them into sending money or divulging information that ultimately enables Financial Theft.

Authoring guide

Patterns shared across the 1 rule above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (8 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
azure.signinlogs.properties.authentication_processing_details1contains 1user_impersonation
azure.signinlogs.properties.conditional_access_status1eq 1notApplied
azure.signinlogs.properties.token_issuer_type1eq 1AzureAD
azure.signinlogs.properties.token_protection_status_details.sign_in_session_status1eq 1unbound
azure_ad::authentication_requirement1eq 1singleFactorAuthentication
azure_ad::user_type1eq 1Member
data_stream.dataset1eq 1azure.signinlogs
event.outcome1eq 1success

Top indicator values (8 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
azure.signinlogs.properties.authentication_processing_detailscontains
user_impersonation
1
azure.signinlogs.properties.conditional_access_statuseq
notApplied
1
azure.signinlogs.properties.token_issuer_typeeq
AzureAD
12
azure.signinlogs.properties.token_protection_status_details.sign_in_session_statuseq
unbound
13
azure_ad::authentication_requirementeq
singleFactorAuthentication
18
azure_ad::user_typeeq
Member
110
data_stream.dataseteq
azure.signinlogs
130
event.outcomeeq
success
1251

Exclusions (19 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
aws::userAgentwildcard
Microsoft*Authentication*iPhone*
1
aws::userAgentwildcard
Mozilla*PKeyAuth/1.0
1
azure.signinlogs.properties.device_detail.operating_systemstarts_with
Android
1
azure.signinlogs.properties.device_detail.operating_systemstarts_with
Ios
1
azure_ad::app_idin
0000000c-0000-0000-c000-000000000000
1
azure_ad::app_idin
0a5f63c0-b750-4f38-a71c-4fc0d58b89e2
1
azure_ad::app_idin
48af08dc-f6d2-435f-b2a7-069abd99c086
1
azure_ad::app_idin
5e3ce6c0-2b1f-4285-8d4b-75ee78787346
1
azure_ad::app_idin
65d91a3d-ab74-42e6-8a2f-0add61688c74
1
azure_ad::app_idin
66a88757-258c-4c72-893c-3e8bed4d6899
1
azure_ad::app_idin
6bc3b958-689b-49f5-9006-36d165f30e00
1
azure_ad::app_idin
8c59ead7-d703-4a27-9e55-c96a0054c8d2
1
azure_ad::app_idin
95de633a-083e-42f5-b444-a4295d8e9314
1
azure_ad::app_idin
a5f63c0-b750-4f38-a71c-4fc0d58b89e2
1
azure_ad::app_idin
ab9b8c07-8f02-4f72-87fa-80105867a763
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Elastic 1 rule