Gather Victim Identity Information: recognize the technique

Lesson Purpose

What you are learning

This technique is about learning who works with an organization and how its accounts are named. Useful details can include employee names, job roles, email patterns, contact information, and account identifiers. Defenders should know what identity information is public and reduce details that are not needed.

Learning Objectives

Explain Gather Victim Identity Information in plain language.
Identify evidence a defender could review.
Choose a defensive action that fits the observed behavior.

Why This Matters

Public identity information can help an attacker choose believable targets or guess account names. The information alone does not prove that an account is compromised. Defenders should compare public information with login and account activity before drawing conclusions.

OWASP Web Security Testing Guide (WSTG)

Use a repeatable web-testing method

Connect this ATT&CK training activity to the WSTG approach: establish expected behavior, identify the relevant attack surface, change one controlled input or observation at a time, compare the response with the baseline, and record evidence before drawing a conclusion.

For reconnaissance-oriented lessons such as T1595, treat reachability, exposed services, and observable application behavior as information gathering. A reachable service is evidence about exposure; it is not by itself proof of a vulnerability.

Open WSTG web security fundamentals

Exercise

Before You Practice

Practice Preparation

Use these lesson concepts for the ungraded practice activity below. You do not need outside research.

Identity information can come from organization-owned directories, approved HR/identity records, public staff/contact information, and authentication or account records.
Ask whether the identity information is current, necessary to expose, and consistent across authoritative sources.
Reduce unnecessary identity exposure through data minimization, publication review, access controls, and removal of stale contact/account information.

This is ungraded practice. Use the lesson material above; exact wording is not required. List three places a defender could check for identity-related evidence. Then name one question that would help separate public identity information from account misuse and two controls that reduce risk. No external target interaction is required.

Knowledge Check

Check your understanding

Answer the questions shown below. You must answer at least 2 correctly before marking this concept lesson complete.

1. Which statement best describes Gather Victim Identity Information? This technique is about learning who works with an organization and how its accounts are named. This technique is about learning how an organization's network is arranged and exposed. This technique is about learning how an organization works.

2. A defender is investigating activity related to the behavior described in this lesson. Which evidence set would provide the most relevant context? Login logs, account inventories, email-security events, and reports of exposed credentials DNS and IP inventories, cloud records, firewall rules, flow logs, and network diagrams Public websites, organization charts, supplier information, recruiting material, and impersonation reports

3. Which interpretation best avoids overstating what the observed information proves? Public identity information can increase risk, but it is not the same as account compromise. Outside network information is only a partial view. Defenders should compare it with an accurate internal inventory. Normal business information can become security-relevant when several public facts are combined.

4. Consider this behavior: This technique is about learning who works with an organization and how its accounts are named. Useful details can include employee names, job roles, email patterns, contact information, and account identifiers. Which ATT&CK technique best matches the behavior? Gather Victim Identity Information Gather Victim Network Information Gather Victim Org Information

5. A defender wants to reduce or validate the risk described in this scenario. Which response is the most appropriate? Check whether unusual login or recovery activity followed the exposure, and use strong MFA and account-recovery controls Compare public exposure with the approved network inventory and remove or restrict services that should not be public Review public information before publication and independently verify sensitive requests that use real company details

6. Which limitation should a defender keep in mind before drawing a conclusion from this evidence? Knowing a person's name or email address does not prove that the account is compromised An outside network view can be incomplete or outdated A public business fact may be harmless alone but more useful when combined with other facts

Learning Moment

Public identity information can increase risk, but it is not the same as account compromise. Defenders should confirm context with more than one source and reduce unnecessary exposure where practical.

Defender Perspective

Useful evidence includes identity and login logs, account inventories, email-security events, public staff pages, help-desk records, and reports of exposed credentials. Check whether the account is current, whether unusual logins or password resets followed the exposure, and whether the activity fits the user's normal behavior. Reduce risk with strong MFA, careful account recovery, removal of stale accounts, and less unnecessary public identity detail. Risk reduction includes reviewing what is exposed and using controls to limit information that is not needed.

Continue Your Learning Pathway

Next Step · Continue ATT&CK Training

Continue building your reconnaissance and resource-development foundation with the next ATT&CK lesson.

Complete this lesson first. Finish the required lesson activity and knowledge check, if present, before continuing.

Return to dashboard