Fake Social Media Personas: Defending Against T1585.001

Establish Accounts: Social Media Accounts (T1585.001) is a resource development technique tagged PRE. The adversary creates and cultivates social media accounts to support targeting.

How attackers use it

MITRE says an adversary builds a persona with public information, presence, history and affiliations. For social engineering operations, a persona on social media may matter. It may be fictitious or impersonate a real person, on one site or several. MITRE names Facebook, LinkedIn and Twitter.

Making the persona believable may take extra work: profile details, a network of connections and photos. Once the persona exists, the adversary uses it to connect with targets, directly or through others. MITRE lists spearphishing via service as a way the account can support initial access.

How to detect it

MITRE suggests monitoring social media activity related to your organization. Suspicious activity may include personas that claim to work for your organization, or recently created or modified accounts that send many connection requests to accounts affiliated with your organization.

It also lists network analysis ideas for the later stages, including protocol anomalies and correlation with process monitoring.

A simple routine, as general practice: compare people who say they work for you with your directory, and ask staff to forward odd connection requests.

How to reduce the risk

MITRE's mitigation is Pre-compromise: you cannot easily prevent someone from creating an account.

General practice for the human side:

• Tell staff what a persona approach looks like, and how to report one.
• Verify unknown contacts through a second channel before sharing anything internal.
• Report fake profiles that impersonate your company or your staff to the platform.

Quick check

Sources

• MITRE ATT&CK T1585.001: Social Media Accounts