Adversaries may gather employee names for use during targeting. MITRE lists this under Reconnaissance with platform PRE.
A name looks harmless. Its value to an attacker is what it lets them build next.
How attackers use it
MITRE says names can be used to derive email addresses, to guide other reconnaissance, and to make lures more believable.
Names are easy to find. MITRE points to social media and the victim's own websites as typical sources. The information can lead to further reconnaissance, to compromised accounts used as operational resources, and to initial access through phishing or valid accounts.
There is a small defensive benefit in knowing this. If names are public, then a message that uses a correct name is not evidence of anything. Train for that.
How to detect it
MITRE notes that this activity may have a very high occurrence and false positive rate, and may happen outside your visibility. That makes direct detection difficult.
Its advice is to look at related stages, such as initial access. The practical signal is a lure that uses real names correctly: a message that references a colleague, a manager, or a team accurately but arrives from an unexpected sender.
How to reduce the risk
- MITRE says this cannot be easily mitigated and that efforts should focus on minimizing the amount and sensitivity of data available to external parties.
- Decide which staff genuinely need a public profile and let the rest opt out where practical.
- Teach staff that a correct name proves nothing about who is writing.
- Add a clear external sender marker to inbound mail, and make reporting easy.
Quick check
What do attackers do with employee names?
Derive email addresses, guide other reconnaissance, and make lures more believable.
Is detection realistic at this stage?
Not directly. MITRE says to focus on related stages such as initial access.
Sources
- MITRE ATT&CK, Employee Names (T1589.003): https://attack.mitre.org/techniques/T1589/003
