# T1585 - Establish Accounts

## SOC Recommendation
Investigate Establish Accounts activity in the context of Resource Development: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Network Traffic Analysis | Detect | Monitor for Network Traffic Analysis indicators relevant to this technique. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Revoke the OAuth consent: Entra ID → Enterprise applications | Medium | No | Yes |
| Delete the app registration if attacker-created | Low | No | Yes |
| Check CloudAppEvents for data accessed via the app | Low | Yes | No |
| Enable admin consent policy — require admin approval for all | Low | No | Yes |

## KQL
```kql
let HighRiskPerms = dynamic([
    "Mail.Read", "Mail.ReadWrite", "Mail.Send", "MailboxSettings.ReadWrite",
    "Files.Read.All", "Files.ReadWrite.All", "Sites.Read.All", "Sites.ReadWrite.All",
    "Calendars.ReadWrite", "Contacts.Read", "People.Read.All",
    "User.ReadWrite.All", "Group.ReadWrite.All", "Directory.ReadWrite.All",
    "Application.ReadWrite.All", "AppRoleAssignment.ReadWrite.All",
    "RoleManagement.ReadWrite.Directory", "offline_access", "full_access_as_app"
]);
let auditLogsSource =
    union isfuzzy=true AuditLogs,
    (datatable(TimeGenerated:datetime, OperationName:string, InitiatedBy:dynamic, TargetResources:dynamic, AdditionalDetails:dynamic, Result:string)[]);
let NewAppRegistrations =
    auditLogsSource
    | where TimeGenerated >= ago(1h)
    | where OperationName in~ ("Add application", "Add service principal", "Add OAuth2PermissionGrant")
    | extend Actor = tostring(InitiatedBy.user.userPrincipalName),
             AppName = tostring(TargetResources[0].displayName),
             Permissions = strcat(tostring(TargetResources[0].modifiedProperties), " ", tostring(AdditionalDetails))
    | where Permissions has_any (HighRiskPerms)
    | project TimeGenerated, Actor, AppName, OperationName, Detail = Permissions, Result, DetectionPath = "HighRiskAppRegistration";
let ConsentGrants =
    auditLogsSource
    | where TimeGenerated >= ago(1h)
    | where OperationName =~ "Consent to application"
    | extend Actor = tostring(InitiatedBy.user.userPrincipalName),
             AppName = tostring(TargetResources[0].displayName),
             Scopes = strcat(tostring(TargetResources[0].modifiedProperties), " ", tostring(AdditionalDetails))
    | where Scopes has_any (HighRiskPerms)
    | project TimeGenerated, Actor, AppName, OperationName, Detail = Scopes, Result, DetectionPath = "HighRiskConsentGrant";
NewAppRegistrations
| union ConsentGrants
| extend timestamp = TimeGenerated,
         AccountCustomEntity = Actor
| order by TimeGenerated desc
```
```kql
// High severity - Executive/People Impersonation
let timeFrame = 5m;
CyfirmaBIExecutivePeopleAlerts_CL
| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
| extend
    Description=description,
    FirstSeen=first_seen,
    LastSeen=last_seen,
    RiskScore=risk_score,
    AlertUID=alert_uid,
    UID=uid,
    AssetType=asset_type,
    AssetValue=asset_value,
    Impact=impact,
    Recommendation=recommendation,
    PostedDate=posted_date,
    ProviderName='CYFIRMA',
    ProductName='DeCYFIR/DeTCT'
| project
    TimeGenerated,
    Description,
    RiskScore,
    FirstSeen,
    LastSeen,
    AlertUID,
    UID,
    AssetType,
    AssetValue,
    Impact,
    Recommendation,
    PostedDate,
    ProductName,
    ProviderName
```
```kql
// High severity - Product/Solution Impersonation
let timeFrame = 5m;
CyfirmaBIProductSolutionAlerts_CL
| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
| extend
    Description=description,
    FirstSeen=first_seen,
    LastSeen=last_seen,
    RiskScore=risk_score,
    AlertUID=alert_uid,
    UID=uid,
    AssetType=asset_type,
    AssetValue=asset_value,
    Impact=impact,
    Recommendation=recommendation,
    SourceSype=source_type,
    ProviderName='CYFIRMA',
    ProductName='DeCYFIR/DeTCT'
| project
    TimeGenerated,
    Description,
    RiskScore,
    FirstSeen,
    LastSeen,
    AlertUID,
    UID,
    AssetType,
    AssetValue,
    Impact,
    Recommendation,
    SourceSype,
    ProductName,
    ProviderName
```

## Escalation Criteria
- Establish Accounts activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.