TA0043 · RECONNAISSANCE
Gather Victim Identity Information
Harvesting employee names, email formats, and credentials from breach dumps and social platforms.
Detect it with
Monitor credential-leak feeds for corporate domains; watch for authentication attempts against accounts that never existed.
Why it matters on shift
Gather Victim Identity Information is one of the concrete ways adversaries achieve reconnaissance. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After reconnaissance, the next tactic is usually Resource Development. Search your telemetry for the transition before closing the ticket.
3 sub-techniques
How it shows up in practice
- T1589.001
Credentials
Adversaries may gather credentials that can be used during targeting.
- T1589.002
Email Addresses
Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees.
- T1589.003
Employee Names
Adversaries may gather employee names that can be used during targeting. Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures.
Kill-chain context