# T1589 - Gather Victim Identity Information

## SOC Recommendation
Investigate Gather Victim Identity Information activity in the context of Reconnaissance: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Network Traffic Analysis | Detect | Monitor for Network Traffic Analysis indicators relevant to this technique. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Force password reset for all accounts found in breach data | Medium | No | Yes |
| Enable MFA for any affected accounts not already using MFA | Low | No | Yes |
| Check sign-in logs for those accounts for existing compromis | Low | Yes | No |
| Register with HaveIBeenPwned domain monitoring for ongoing a | Low | No | Yes |

## KQL
```kql
ThreatIntelligenceIndicator
| where TimeGenerated >= ago(1d)
| where Active == true
| where IndicatorType in ("email", "url", "domain")
| where Tags has_any ("breach", "credential", "paste", "darkweb", "haveibeenpwned", "combolist")
| where EmailSenderAddress has_any (_GetWatchlist('InternalEmailDomains')
    | extend DomainKey = tostring(column_ifexists("SearchKey", column_ifexists("domain", column_ifexists("Domain", ""))))
    | where isnotempty(DomainKey)
    | project DomainKey)
    or DomainName has_any (_GetWatchlist('InternalEmailDomains')
    | extend DomainKey = tostring(column_ifexists("SearchKey", column_ifexists("domain", column_ifexists("Domain", ""))))
    | where isnotempty(DomainKey)
    | project DomainKey)
| project
    TimeGenerated, IndicatorType, EmailSenderAddress, DomainName,
    Description, ConfidenceScore, Tags, ExpirationDateTime
| extend timestamp = TimeGenerated, AccountCustomEntity = EmailSenderAddress
| order by ConfidenceScore desc
```
```kql
// High severity - Executive/People Impersonation
let timeFrame = 5m;
CyfirmaBIExecutivePeopleAlerts_CL
| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
| extend
    Description=description,
    FirstSeen=first_seen,
    LastSeen=last_seen,
    RiskScore=risk_score,
    AlertUID=alert_uid,
    UID=uid,
    AssetType=asset_type,
    AssetValue=asset_value,
    Impact=impact,
    Recommendation=recommendation,
    PostedDate=posted_date,
    ProviderName='CYFIRMA',
    ProductName='DeCYFIR/DeTCT'
| project
    TimeGenerated,
    Description,
    RiskScore,
    FirstSeen,
    LastSeen,
    AlertUID,
    UID,
    AssetType,
    AssetValue,
    Impact,
    Recommendation,
    PostedDate,
    ProductName,
    ProviderName
```
```kql
// High severity - Social Media Handle Impersonation
let timeFrame = 5m;
CyfirmaBISocialHandlersAlerts_CL 
  | where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
  | extend
      Description=description,
      FirstSeen=first_seen,
      LastSeen=last_seen,
      RiskScore=risk_score,
      AlertUID=alert_uid,
      UID=uid,
      AssetType=asset_type,
      AssetValue=asset_value,
      Impact=impact,
      Recommendation=recommendation,
      SourceSype=source_type,
      ProviderName="CYFIRMA",
      ProductName="DeCYFIR/DeTCT"
  | project 
      TimeGenerated,
      Description,
      RiskScore,
      FirstSeen,
      LastSeen,
      AlertUID,
      UID,
      AssetType,
      AssetValue,
      Impact,
      Recommendation,
      SourceSype,
      ProductName,
      ProviderName
```

## Escalation Criteria
- Gather Victim Identity Information activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.