Establish Accounts: Email Accounts (T1585.002) is a resource development technique tagged PRE. The adversary creates email accounts to use in later stages.
How attackers use it
MITRE says adversaries use accounts from email providers to support phishing for information and phishing. They may also abuse free services, such as trial periods, to acquire infrastructure for follow-on purposes. A created email account can help in registering domains and other resources.
They may build a persona around the email account, for example with social media accounts, to raise the chance of success. To reduce the chance of being tied back to them, adversaries may use disposable email services.
How to detect it
MITRE says much of this activity is outside the visibility of the target organization. Detection effort should focus on related stages of the lifecycle, such as initial access through phishing.
Mail gateway signals, as general practice: first-time senders from free mail providers, sender display names that mimic your staff, mismatched reply-to addresses, and messages with urgency and links.
How to reduce the risk
MITRE lists Pre-compromise: preventive controls cannot easily stop account creation at a mail provider.
General practice on your side:
- Tag messages from outside your organization so that recipients can see them.
- Publish SPF, DKIM and DMARC for your own domains so that others can trust your mail and spoofing is harder.
- Offer a one-click report button for phishing and act on reports.
Keep the report path short. A phishing report button that sends the message to the security team, with headers intact, gives analysts the sending account and the infrastructure behind it.
Quick check
Why might adversaries use disposable email services?
To reduce the chance of operations being physically tied back to them.
Where does MITRE say detection effort belongs?
On related stages such as initial access through phishing, since account creation is outside your visibility.
