Adversaries may search social media for information about victims. MITRE lists this under Reconnaissance with platform PRE. Social media can carry business announcements and details about the roles, locations, and interests of staff.
How attackers use it
MITRE says adversaries may passively harvest data from these sites. They may also use what they learn to create fake profiles or groups to get victims to reveal specific information, which MITRE ties to spearphishing via service.
Results can lead to phishing for information, searches of open technical databases, creating or compromising accounts, and initial access through spearphishing via service.
How to detect it
MITRE notes that this activity may have a very high occurrence and false positive rate, and may take place outside your visibility, which makes detection difficult. Its advice is to focus on related stages of the adversary lifecycle, such as initial access.
A connection request or message from an account that fits the profile of a recruiter or peer and asks about internal work is the visible edge of this activity. Let staff report them.
How to reduce the risk
- MITRE says this technique cannot be easily mitigated with preventive controls, because it is based on behaviors performed outside the scope of enterprise defenses and controls. Its guidance is to minimize the amount and sensitivity of data available to external parties.
- Write a short social media guide for staff that covers badges, screens, and project details in photos.
- Tell staff how to report suspicious contact requests, and act on the reports.
- Review company page posts before they go out.
Quick check
What do fake profiles do for an adversary?
They help draw victims into revealing specific information, which MITRE links to spearphishing via service.
What can social media reveal?
Business announcements, and the roles, locations, and interests of staff.
Sources
- MITRE ATT&CK, Social Media (T1593.001): https://attack.mitre.org/techniques/T1593/001
