T1589 — Gather Victim Identity Information

# T1589 - Gather Victim Identity Information

## SOC Recommendation
Investigate Gather Victim Identity Information activity in the context of Reconnaissance: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Network Traffic Analysis | Detect | Monitor for Network Traffic Analysis indicators relevant to this technique. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Force password reset for all accounts found in breach data | Medium | No | Yes |
| Enable MFA for any affected accounts not already using MFA | Low | No | Yes |
| Check sign-in logs for those accounts for existing compromis | Low | Yes | No |
| Register with HaveIBeenPwned domain monitoring for ongoing a | Low | No | Yes |

## KQL
```kql
ThreatIntelligenceIndicator
| where TimeGenerated >= ago(1d)
| where Active == true
| where IndicatorType in ("email", "url", "domain")
| where Tags has_any ("breach", "credential", "paste", "darkweb", "haveibeenpwned", "combolist")
| where EmailSenderAddress has_any (_GetWatchlist('InternalEmailDomains')
    | extend DomainKey = tostring(column_ifexists("SearchKey", column_ifexists("domain", column_ifexists("Domain", ""))))
    | where isnotempty(DomainKey)
    | project DomainKey)
    or DomainName has_any (_GetWatchlist('InternalEmailDomains')
    | extend DomainKey = tostring(column_ifexists("SearchKey", column_ifexists("domain", column_ifexists("Domain", ""))))
    | where isnotempty(DomainKey)
    | project DomainKey)
| project
    TimeGenerated, IndicatorType, EmailSenderAddress, DomainName,
    Description, ConfidenceScore, Tags, ExpirationDateTime
| extend timestamp = TimeGenerated, AccountCustomEntity = EmailSenderAddress
| order by ConfidenceScore desc
```
```kql
// High severity - Executive/People Impersonation
let timeFrame = 5m;
CyfirmaBIExecutivePeopleAlerts_CL
| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
| extend
    Description=description,
    FirstSeen=first_seen,
    LastSeen=last_seen,
    RiskScore=risk_score,
    AlertUID=alert_uid,
    UID=uid,
    AssetType=asset_type,
    AssetValue=asset_value,
    Impact=impact,
    Recommendation=recommendation,
    PostedDate=posted_date,
    ProviderName='CYFIRMA',
    ProductName='DeCYFIR/DeTCT'
| project
    TimeGenerated,
    Description,
    RiskScore,
    FirstSeen,
    LastSeen,
    AlertUID,
    UID,
    AssetType,
    AssetValue,
    Impact,
    Recommendation,
    PostedDate,
    ProductName,
    ProviderName
```
```kql
// High severity - Social Media Handle Impersonation
let timeFrame = 5m;
CyfirmaBISocialHandlersAlerts_CL 
  | where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
  | extend
      Description=description,
      FirstSeen=first_seen,
      LastSeen=last_seen,
      RiskScore=risk_score,
      AlertUID=alert_uid,
      UID=uid,
      AssetType=asset_type,
      AssetValue=asset_value,
      Impact=impact,
      Recommendation=recommendation,
      SourceSype=source_type,
      ProviderName="CYFIRMA",
      ProductName="DeCYFIR/DeTCT"
  | project 
      TimeGenerated,
      Description,
      RiskScore,
      FirstSeen,
      LastSeen,
      AlertUID,
      UID,
      AssetType,
      AssetValue,
      Impact,
      Recommendation,
      SourceSype,
      ProductName,
      ProviderName
```

## Escalation Criteria
- Gather Victim Identity Information activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1589.json
• /api/recommendations/T1589.json
• /api/d3fend/T1589.json
• /api/mappings/T1589.json
• /api/confluence/T1589.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1589.json

Response:

{
  "technique_id": "T1589",
  "name": "Gather Victim Identity Information",
  "priority": "high",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Reconnaissance"
  ],
  "platforms": [
    "PRE"
  ],
  "summary": "Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations...",
  "soc_recommendation": "Investigate Gather Victim Identity Information activity in the context of Reconnaissance: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-NTA",
      "name": "Network Traffic Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for Network Traffic Analysis indicators relevant to this technique.",
      "tooling": [
        "Sentinel",
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed gather victim identity information activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Credential Exposure via OSINT or Breach Data\" -- Flags organisation credentials or email addresses found in third-party breach datasets, paste sites, or dark web forums. Requires Microsoft Defender Threat Intelligence (MDTI) or a threat intel feed with breach data connected to Sentinel."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Force password reset for all accounts found in breach data",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Enable MFA for any affected accounts not already using MFA",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Check sign-in logs for those accounts for existing compromis",
      "category": "Response",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide",
      "notes": "Check sign-in logs for those accounts for existing compromise signs"
    },
    {
      "name": "Register with HaveIBeenPwned domain monitoring for ongoing a",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Register with HaveIBeenPwned domain monitoring for ongoing alerts"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-RC-002 — Credential Exposure via OSINT or Breach Data",
        "description": "Flags organisation credentials or email addresses found in third-party breach datasets, paste sites, or dark web forums. Requires Microsoft Defender Threat Intelligence (MDTI) or a threat intel feed with breach data connected to Sentinel. (Source: Bell Integration baseline detection library, mapped via sub-technique T1589.001.)",
        "query": "ThreatIntelligenceIndicator\n| where TimeGenerated >= ago(1d)\n| where Active == true\n| where IndicatorType in (\"email\", \"url\", \"domain\")\n| where Tags has_any (\"breach\", \"credential\", \"paste\", \"darkweb\", \"haveibeenpwned\", \"combolist\")\n| where EmailSenderAddress has_any (_GetWatchlist('InternalEmailDomains')\n    | extend DomainKey = tostring(column_ifexists(\"SearchKey\", column_ifexists(\"domain\", column_ifexists(\"Domain\", \"\"))))\n    | where isnotempty(DomainKey)\n    | project DomainKey)\n    or DomainName has_any (_GetWatchlist('InternalEmailDomains')\n    | extend DomainKey = tostring(column_ifexists(\"SearchKey\", column_ifexists(\"domain\", column_ifexists(\"Domain\", \"\"))))\n    | where isnotempty(DomainKey)\n    | project DomainKey)\n| project\n    TimeGenerated, IndicatorType, EmailSenderAddress, DomainName,\n    Description, ConfidenceScore, Tags, ExpirationDateTime\n| extend timestamp = TimeGenerated, AccountCustomEntity = EmailSenderAddress\n| order by ConfidenceScore desc"
      },
      {
        "name": "159d26a1-591c-4f70-b1ca-2843c881aaec — CYFIRMA - Brand Intelligence - Executive/People Impersonation High Rule",
        "description": "\"This rule detects potential impersonation of executive or high-profile individuals across digital platforms such as social media. Such impersonation can be used to mislead stakeholders, perform social engineering attacks, or cause reputational damage to the organization. Timely detection is crucial to assess risk and take down malicious profiles to protect brand and executive identity.\" (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed), mapped via sub-technique T1589.003.)",
        "query": "// High severity - Executive/People Impersonation\nlet timeFrame = 5m;\nCyfirmaBIExecutivePeopleAlerts_CL\n| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())\n| extend\n    Description=description,\n    FirstSeen=first_seen,\n    LastSeen=last_seen,\n    RiskScore=risk_score,\n    AlertUID=alert_uid,\n    UID=uid,\n    AssetType=asset_type,\n    AssetValue=asset_value,\n    Impact=impact,\n    Recommendation=recommendation,\n    PostedDate=posted_date,\n    ProviderName='CYFIRMA',\n    ProductName='DeCYFIR/DeTCT'\n| project\n    TimeGenerated,\n    Description,\n    RiskScore,\n    FirstSeen,\n    LastSeen,\n    AlertUID,\n    UID,\n    AssetType,\n    AssetValue,\n    Impact,\n    Recommendation,\n    PostedDate,\n    ProductName,\n    ProviderName"
      },
      {
        "name": "22f49d67-7da7-4809-8d07-89e4478aa6b0 — CYFIRMA - Brand Intelligence - Social Media Handle Impersonation Detected High Rule",
        "description": "\"Detects high-severity alerts related to impersonation of official social media handles associated with your brand. These spoofed accounts may be used for phishing, disinformation, or fraud campaigns, posing significant reputational and security risks.\" (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed), mapped via sub-technique T1589.003.)",
        "query": "// High severity - Social Media Handle Impersonation\nlet timeFrame = 5m;\nCyfirmaBISocialHandlersAlerts_CL \n  | where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())\n  | extend\n      Description=description,\n      FirstSeen=first_seen,\n      LastSeen=last_seen,\n      RiskScore=risk_score,\n      AlertUID=alert_uid,\n      UID=uid,\n      AssetType=asset_type,\n      AssetValue=asset_value,\n      Impact=impact,\n      Recommendation=recommendation,\n      SourceSype=source_type,\n      ProviderName=\"CYFIRMA\",\n      ProductName=\"DeCYFIR/DeTCT\"\n  | project \n      TimeGenerated,\n      Description,\n      RiskScore,\n      FirstSeen,\n      LastSeen,\n      AlertUID,\n      UID,\n      AssetType,\n      AssetValue,\n      Impact,\n      Recommendation,\n      SourceSype,\n      ProductName,\n      ProviderName"
      }
    ],
    "spl": [],
    "esql": []
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Gather Victim Identity Information activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1589 - Gather Victim Identity Information Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}