Adversaries may gather information about identities and roles within a victim organization. MITRE lists this under Reconnaissance with platform PRE. Role data can reveal identifiable information about key personnel and what data and resources they can access.
How attackers use it
MITRE says the information may be gathered through direct elicitation, such as phishing for information, or from data sets such as social media and the victim's own websites.
Results can lead to more reconnaissance, the creation or compromise of accounts, and initial access through phishing. A message to the finance lead about a payment, or to a system administrator about access, has a better chance than a generic one.
How to detect it
MITRE notes that this activity may have a very high occurrence and false positive rate, and may take place outside your visibility, which makes detection difficult. Its advice is to focus on related stages of the adversary lifecycle, such as initial access.
The signal is targeted phishing aimed at specific roles. Collect reports from the roles most often named publicly, and look for patterns.
How to reduce the risk
- MITRE says this technique cannot be easily mitigated with preventive controls, because it is based on behaviors performed outside the scope of enterprise defenses and controls. Its guidance is to minimize the amount and sensitivity of data available to external parties.
- Give high exposure roles extra protection, such as stricter authentication and mailbox filtering.
- Apply least privilege, so a successful lure against one role reaches little.
- Require a second approval for payments and access changes.
Quick check
Which roles deserve extra protection?
Those that are publicly visible and hold valuable access, such as finance and administration.
What reduces the impact of a targeted lure?
Least privilege and a second approval step for sensitive actions.
Sources
- MITRE ATT&CK, Identify Roles (T1591.004): https://attack.mitre.org/techniques/T1591/004
