TA0042 · RESOURCE DEVELOPMENT
Compromise Accounts
Taking over legitimate email or social accounts so that later phishing arrives from a trusted sender.
Detect it with
Inbound mail passing SPF/DKIM from a real partner domain but with anomalous language or an unexpected attachment.
Why it matters on shift
Compromise Accounts is one of the concrete ways adversaries achieve resource development. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After resource development, the next tactic is usually Initial Access. Search your telemetry for the transition before closing the ticket.
3 sub-techniques
How it shows up in practice
- T1586.001
Social Media Accounts
Adversaries may compromise social media accounts that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important.
- T1586.002
Email Accounts
Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct Phishing for Information, Phishing, or large-scale spam email campaigns.
- T1586.003
Cloud Accounts
Adversaries may compromise cloud accounts that can be used during targeting.
Kill-chain context