T1585 — Establish Accounts

# T1585 - Establish Accounts

## SOC Recommendation
Investigate Establish Accounts activity in the context of Resource Development: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Network Traffic Analysis | Detect | Monitor for Network Traffic Analysis indicators relevant to this technique. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Revoke the OAuth consent: Entra ID → Enterprise applications | Medium | No | Yes |
| Delete the app registration if attacker-created | Low | No | Yes |
| Check CloudAppEvents for data accessed via the app | Low | Yes | No |
| Enable admin consent policy — require admin approval for all | Low | No | Yes |

## KQL
```kql
let HighRiskPerms = dynamic([
    "Mail.Read", "Mail.ReadWrite", "Mail.Send", "MailboxSettings.ReadWrite",
    "Files.Read.All", "Files.ReadWrite.All", "Sites.Read.All", "Sites.ReadWrite.All",
    "Calendars.ReadWrite", "Contacts.Read", "People.Read.All",
    "User.ReadWrite.All", "Group.ReadWrite.All", "Directory.ReadWrite.All",
    "Application.ReadWrite.All", "AppRoleAssignment.ReadWrite.All",
    "RoleManagement.ReadWrite.Directory", "offline_access", "full_access_as_app"
]);
let auditLogsSource =
    union isfuzzy=true AuditLogs,
    (datatable(TimeGenerated:datetime, OperationName:string, InitiatedBy:dynamic, TargetResources:dynamic, AdditionalDetails:dynamic, Result:string)[]);
let NewAppRegistrations =
    auditLogsSource
    | where TimeGenerated >= ago(1h)
    | where OperationName in~ ("Add application", "Add service principal", "Add OAuth2PermissionGrant")
    | extend Actor = tostring(InitiatedBy.user.userPrincipalName),
             AppName = tostring(TargetResources[0].displayName),
             Permissions = strcat(tostring(TargetResources[0].modifiedProperties), " ", tostring(AdditionalDetails))
    | where Permissions has_any (HighRiskPerms)
    | project TimeGenerated, Actor, AppName, OperationName, Detail = Permissions, Result, DetectionPath = "HighRiskAppRegistration";
let ConsentGrants =
    auditLogsSource
    | where TimeGenerated >= ago(1h)
    | where OperationName =~ "Consent to application"
    | extend Actor = tostring(InitiatedBy.user.userPrincipalName),
             AppName = tostring(TargetResources[0].displayName),
             Scopes = strcat(tostring(TargetResources[0].modifiedProperties), " ", tostring(AdditionalDetails))
    | where Scopes has_any (HighRiskPerms)
    | project TimeGenerated, Actor, AppName, OperationName, Detail = Scopes, Result, DetectionPath = "HighRiskConsentGrant";
NewAppRegistrations
| union ConsentGrants
| extend timestamp = TimeGenerated,
         AccountCustomEntity = Actor
| order by TimeGenerated desc
```
```kql
// High severity - Executive/People Impersonation
let timeFrame = 5m;
CyfirmaBIExecutivePeopleAlerts_CL
| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
| extend
    Description=description,
    FirstSeen=first_seen,
    LastSeen=last_seen,
    RiskScore=risk_score,
    AlertUID=alert_uid,
    UID=uid,
    AssetType=asset_type,
    AssetValue=asset_value,
    Impact=impact,
    Recommendation=recommendation,
    PostedDate=posted_date,
    ProviderName='CYFIRMA',
    ProductName='DeCYFIR/DeTCT'
| project
    TimeGenerated,
    Description,
    RiskScore,
    FirstSeen,
    LastSeen,
    AlertUID,
    UID,
    AssetType,
    AssetValue,
    Impact,
    Recommendation,
    PostedDate,
    ProductName,
    ProviderName
```
```kql
// High severity - Product/Solution Impersonation
let timeFrame = 5m;
CyfirmaBIProductSolutionAlerts_CL
| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
| extend
    Description=description,
    FirstSeen=first_seen,
    LastSeen=last_seen,
    RiskScore=risk_score,
    AlertUID=alert_uid,
    UID=uid,
    AssetType=asset_type,
    AssetValue=asset_value,
    Impact=impact,
    Recommendation=recommendation,
    SourceSype=source_type,
    ProviderName='CYFIRMA',
    ProductName='DeCYFIR/DeTCT'
| project
    TimeGenerated,
    Description,
    RiskScore,
    FirstSeen,
    LastSeen,
    AlertUID,
    UID,
    AssetType,
    AssetValue,
    Impact,
    Recommendation,
    SourceSype,
    ProductName,
    ProviderName
```

## Escalation Criteria
- Establish Accounts activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1585.json
• /api/recommendations/T1585.json
• /api/d3fend/T1585.json
• /api/mappings/T1585.json
• /api/confluence/T1585.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1585.json

Response:

{
  "technique_id": "T1585",
  "name": "Establish Accounts",
  "priority": "high",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Resource Development"
  ],
  "platforms": [
    "PRE"
  ],
  "summary": "Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations...",
  "soc_recommendation": "Investigate Establish Accounts activity in the context of Resource Development: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-NTA",
      "name": "Network Traffic Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for Network Traffic Analysis indicators relevant to this technique.",
      "tooling": [
        "Sentinel",
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed establish accounts activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Malicious OAuth Application Registered or Consented\" -- Flags new OAuth application registration or third-party consent with high-risk Graph/Exchange scopes. PS-001 now covers persistence via service principal credential additions."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Revoke the OAuth consent: Entra ID → Enterprise applications",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Entra ID",
      "notes": "Revoke the OAuth consent: Entra ID → Enterprise applications → [app] → Permissions → Revoke admin consent"
    },
    {
      "name": "Delete the app registration if attacker-created",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Check CloudAppEvents for data accessed via the app",
      "category": "Response",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide"
    },
    {
      "name": "Enable admin consent policy — require admin approval for all",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Enable admin consent policy — require admin approval for all high-permission apps"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-RD-001 — Malicious OAuth Application Registered or Consented",
        "description": "Flags new OAuth application registration or third-party consent with high-risk Graph/Exchange scopes. PS-001 now covers persistence via service principal credential additions. (Source: Bell Integration baseline detection library, mapped via sub-technique T1585.002.)",
        "query": "let HighRiskPerms = dynamic([\n    \"Mail.Read\", \"Mail.ReadWrite\", \"Mail.Send\", \"MailboxSettings.ReadWrite\",\n    \"Files.Read.All\", \"Files.ReadWrite.All\", \"Sites.Read.All\", \"Sites.ReadWrite.All\",\n    \"Calendars.ReadWrite\", \"Contacts.Read\", \"People.Read.All\",\n    \"User.ReadWrite.All\", \"Group.ReadWrite.All\", \"Directory.ReadWrite.All\",\n    \"Application.ReadWrite.All\", \"AppRoleAssignment.ReadWrite.All\",\n    \"RoleManagement.ReadWrite.Directory\", \"offline_access\", \"full_access_as_app\"\n]);\nlet auditLogsSource =\n    union isfuzzy=true AuditLogs,\n    (datatable(TimeGenerated:datetime, OperationName:string, InitiatedBy:dynamic, TargetResources:dynamic, AdditionalDetails:dynamic, Result:string)[]);\nlet NewAppRegistrations =\n    auditLogsSource\n    | where TimeGenerated >= ago(1h)\n    | where OperationName in~ (\"Add application\", \"Add service principal\", \"Add OAuth2PermissionGrant\")\n    | extend Actor = tostring(InitiatedBy.user.userPrincipalName),\n             AppName = tostring(TargetResources[0].displayName),\n             Permissions = strcat(tostring(TargetResources[0].modifiedProperties), \" \", tostring(AdditionalDetails))\n    | where Permissions has_any (HighRiskPerms)\n    | project TimeGenerated, Actor, AppName, OperationName, Detail = Permissions, Result, DetectionPath = \"HighRiskAppRegistration\";\nlet ConsentGrants =\n    auditLogsSource\n    | where TimeGenerated >= ago(1h)\n    | where OperationName =~ \"Consent to application\"\n    | extend Actor = tostring(InitiatedBy.user.userPrincipalName),\n             AppName = tostring(TargetResources[0].displayName),\n             Scopes = strcat(tostring(TargetResources[0].modifiedProperties), \" \", tostring(AdditionalDetails))\n    | where Scopes has_any (HighRiskPerms)\n    | project TimeGenerated, Actor, AppName, OperationName, Detail = Scopes, Result, DetectionPath = \"HighRiskConsentGrant\";\nNewAppRegistrations\n| union ConsentGrants\n| extend timestamp = TimeGenerated,\n         AccountCustomEntity = Actor\n| order by TimeGenerated desc"
      },
      {
        "name": "159d26a1-591c-4f70-b1ca-2843c881aaec — CYFIRMA - Brand Intelligence - Executive/People Impersonation High Rule",
        "description": "\"This rule detects potential impersonation of executive or high-profile individuals across digital platforms such as social media. Such impersonation can be used to mislead stakeholders, perform social engineering attacks, or cause reputational damage to the organization. Timely detection is crucial to assess risk and take down malicious profiles to protect brand and executive identity.\" (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed), mapped via sub-technique T1585.001.)",
        "query": "// High severity - Executive/People Impersonation\nlet timeFrame = 5m;\nCyfirmaBIExecutivePeopleAlerts_CL\n| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())\n| extend\n    Description=description,\n    FirstSeen=first_seen,\n    LastSeen=last_seen,\n    RiskScore=risk_score,\n    AlertUID=alert_uid,\n    UID=uid,\n    AssetType=asset_type,\n    AssetValue=asset_value,\n    Impact=impact,\n    Recommendation=recommendation,\n    PostedDate=posted_date,\n    ProviderName='CYFIRMA',\n    ProductName='DeCYFIR/DeTCT'\n| project\n    TimeGenerated,\n    Description,\n    RiskScore,\n    FirstSeen,\n    LastSeen,\n    AlertUID,\n    UID,\n    AssetType,\n    AssetValue,\n    Impact,\n    Recommendation,\n    PostedDate,\n    ProductName,\n    ProviderName"
      },
      {
        "name": "3a9a81bc-2f41-4d68-9cd1-7788326c92b1 — CYFIRMA - Brand Intelligence - Product/Solution High Rule",
        "description": "\"This alert is raised when CYFIRMA detects a critical reputation score for an IP address linked to your infrastructure. The IP has been previously associated with hacking activity and web application attacks. Denied outbound traffic to a foreign country from a known Microsoft data center IP suggests potential misuse or compromise of cloud infrastructure.\" (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed), mapped via sub-technique T1585.002.)",
        "query": "// High severity - Product/Solution Impersonation\nlet timeFrame = 5m;\nCyfirmaBIProductSolutionAlerts_CL\n| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())\n| extend\n    Description=description,\n    FirstSeen=first_seen,\n    LastSeen=last_seen,\n    RiskScore=risk_score,\n    AlertUID=alert_uid,\n    UID=uid,\n    AssetType=asset_type,\n    AssetValue=asset_value,\n    Impact=impact,\n    Recommendation=recommendation,\n    SourceSype=source_type,\n    ProviderName='CYFIRMA',\n    ProductName='DeCYFIR/DeTCT'\n| project\n    TimeGenerated,\n    Description,\n    RiskScore,\n    FirstSeen,\n    LastSeen,\n    AlertUID,\n    UID,\n    AssetType,\n    AssetValue,\n    Impact,\n    Recommendation,\n    SourceSype,\n    ProductName,\n    ProviderName"
      }
    ],
    "spl": [],
    "esql": []
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Establish Accounts activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1585 - Establish Accounts Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}