Establish Accounts: recognize the technique

Lesson Purpose

What you are learning

This technique is about creating accounts or personas that can support later activity. Accounts may exist on email, social media, collaboration, cloud, developer, or other services. A new account is not automatically suspicious. Defenders should focus on how an account presents itself, what it links to, and how it contacts people connected with the organization.

Learning Objectives

Explain Establish Accounts in plain language.
Identify evidence a defender could review.
Choose a defensive action that fits the observed behavior.

Why This Matters

Accounts used for impersonation or social engineering may exist long before they contact a target. Defenders should focus on how an account presents itself, what it links to, and how it interacts with users. Context such as impersonation, links, and contact patterns helps distinguish ordinary accounts from suspicious use.

OWASP Web Security Testing Guide (WSTG)

Use a repeatable web-testing method

Connect this ATT&CK training activity to the WSTG approach: establish expected behavior, identify the relevant attack surface, change one controlled input or observation at a time, compare the response with the baseline, and record evidence before drawing a conclusion.

For reconnaissance-oriented lessons such as T1595, treat reachability, exposed services, and observable application behavior as information gathering. A reachable service is evidence about exposure; it is not by itself proof of a vulnerability.

Open WSTG web security fundamentals

Exercise

Before You Practice

Practice Preparation

Use these lesson concepts for the ungraded practice activity below. You do not need outside research.

Assess suspicious accounts using profile/history information, account creation or identity records when available, communication/contact patterns, and links or domains the account uses.
Ask whether the account is impersonating a known person/organization or selectively targeting people connected with the organization.
Controls include verification/reporting processes, account/domain monitoring, user awareness, and independent verification before acting on requests.

This is ungraded practice. Use the lesson material above; exact wording is not required. Identify three sources that could help assess a suspicious account. Then give one question that tests whether it is impersonating or targeting the organization and two controls that reduce risk. No external account creation is required.

Knowledge Check

Check your understanding

Answer the questions shown below. You must answer at least 2 correctly before marking this concept lesson complete.

1. Which statement best describes Establish Accounts? This technique is about creating accounts or personas that can support later activity. This technique is about taking control of an existing account for later use. This technique is about creating resources that may support later operations.

2. A defender is investigating activity related to the behavior described in this lesson. Which evidence set would provide the most relevant context? Brand-impersonation reports, email-security events, account metadata, suspicious links, and provider abuse reports Unusual logins, new devices, MFA resets, changed recovery details, new tokens, and unexpected account actions Threat-intelligence reports, malware analysis, vulnerability reports, certificate records, and endpoint detections

3. Which interpretation best avoids overstating what the observed information proves? A new account alone is weak evidence. Behavior, identity claims, and connections provide stronger context. For an established account, changes in authentication, settings, or behavior can be stronger clues than the account name itself. Capability development may be hard to see directly. Combine outside intelligence with internal exposure and activity.

4. Consider this behavior: This technique is about creating accounts or personas that can support later activity. Accounts may exist on email, social media, collaboration, cloud, developer, or other services. Which ATT&CK technique best matches the behavior? Establish Accounts Compromise Accounts Develop Capabilities

5. A defender wants to reduce or validate the risk described in this scenario. Which response is the most appropriate? Check what the account claims to represent and how it interacts with employees or customers Review authentication history and security-setting changes, then revoke suspicious sessions or tokens Check whether the capability applies to technology the organization actually uses, then prioritize relevant protections

6. Which limitation should a defender keep in mind before drawing a conclusion from this evidence? An account should not be treated as malicious only because it is new A familiar account name does not guarantee that the legitimate owner is still in control Evidence that a capability exists is not the same as evidence that it targets the organization

Learning Moment

A new account alone is weak evidence. Behavior, identity claims, and connections provide stronger context.

Defender Perspective

Useful evidence includes brand-impersonation reports, email-security events, account-creation metadata on company services, suspicious links, repeated contact patterns, and provider abuse reports. Check whether the account claims to represent the organization and whether it contacts employees or customers. Reduce risk with verified official channels, reporting mechanisms, anti-impersonation controls, and email authentication.

Continue Your Learning Pathway

Next Step · Continue ATT&CK Training

Continue building your reconnaissance and resource-development foundation with the next ATT&CK lesson.

Complete this lesson first. Finish the required lesson activity and knowledge check, if present, before continuing.

Return to dashboard