Detect it by watching for reconnaissance aimed at collecting names, usernames, email addresses, roles, or organisational details before a login attempt. Look for unusual profile lookups, directory queries, social engineering, and repeated searches against employee identities. Correlate this activity with phishing, password spraying, and account takeover attempts, especially when the same source targets many users.
How attackers gather identity data before the first login attempt
gather victim identity information is a reconnaissance phase, so detection starts by treating early identity collection as suspicious activity rather than harmless curiosity. Security teams should expect name harvesting, title and role enumeration, employee directory probing, and repeated lookups against the same population before any credential use. The key signal is not one lookup, but an organised pattern that helps an attacker prepare phishing, spraying, or account takeover.
Watch for unusual profile views, directory searches, HR-style queries, and contact discovery against employee records, especially when those requests come from external sources, automated tooling, or accounts that have no business need for the data. Focus on volume, repetition, breadth of targets, and whether the activity stays in one department or moves across the enterprise. That spread often shows the attacker is building a target list.
Detection becomes stronger when identity collection lines up with other pre-attack behaviours. A single source that first harvests employee details and then shifts into phishing, password spraying, or takeover attempts is far more important than either activity alone. The useful question is whether the same actor is moving from discovery to access preparation, because that sequence is what turns reconnaissance into a real intrusion path.
Why identity reconnaissance is easy to miss
This activity often blends into normal business traffic because organisations expect employees, partners, and recruiters to search for names, titles, and contact details. The difference is intent and pattern. Legitimate use is usually narrow and contextual; malicious reconnaissance is broad, repetitive, and aimed at building confidence for later social engineering or credential attacks. That makes baselining essential.
Security teams should also treat public-facing data sources as part of the attack surface. LinkedIn-style role mapping, corporate directories, help desk contact pages, and staff bios can all feed the same campaign. If telemetry shows a spike in searches or lookups for senior staff, finance users, administrators, or people tied to authentication workflows, that is often a prelude to a targeted lure rather than random browsing.
For practical detection engineering, the best approach is to correlate identity lookups with email, web, and authentication telemetry rather than reviewing them in isolation. A profile lookup may look benign on its own, but repeated identity resolution followed by login failures, MFA prompts, or suspicious mail delivery changes usually raises the confidence that the activity is malicious.
What analysts should look for in the kill chain
Build detections around sequences, not single events. The most useful pattern is reconnaissance that touches many users, then converges on a smaller set of high-value identities, and finally leads to phishing delivery, password spraying, or account takeover. That progression helps distinguish general curiosity from an active campaign.
Also look for mismatched source behavior, such as the same IP, domain, browser fingerprint, or automation pattern repeatedly querying employee identity data across short intervals. Where available, enrich events with user role, business unit, geolocation, and prior access history so the team can spot target selection. If a source keeps probing the same identity fields across many users, it is usually trying to improve lure quality or password guessing success.
Detection works best when teams define what “normal” identity visibility looks like for each data source. Directory services, collaboration tools, HR systems, and public staff pages each need separate thresholds because normal access patterns differ. That context lets analysts flag identity collection early enough to block the follow-on phishing or access attempt, rather than after credentials are already under attack.
Risk and Threat Considerations
Identity reconnaissance lowers the cost of every later attack. Once an attacker knows names, reporting lines, roles, and likely contact channels, phishing becomes more believable and credential attacks can be targeted at the most useful accounts. The biggest risk is not the lookup itself, but the way it improves the probability of successful impersonation and account compromise.
Failure mechanism: A defender treats identity search activity as low risk because no login has happened yet, so the attacker is free to map people, choose believable pretexts, and line up password spraying or phishing against the most promising targets.
Impact: Increased success rate for phishing, faster progression to account takeover, and higher chance that a broad campaign will blend into normal user discovery before the first security alert fires.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1589 — Gather Victim Identity Information | Directly matches the reconnaissance behaviour described in the question. |
| T1598 — Phishing for Information | Covers pre-attack collection of employee details used to improve social engineering. | |
| T1110 — Brute Force | Password spraying is a common follow-on to identity reconnaissance. | |
| Recommendation — Map identity-harvest alerts to T1589 and alert when collection precedes phishing or login attacks. Correlate identity searches with T1598-style lures and investigate the target list being built. Link identity harvesting to T1110 spray activity and escalate when the same source targets many accounts. | ||
| NIST CSF 2.0 | DE.AE-02 — Detected Anomalies are Analyzed to Understand Threats | Identity reconnaissance is best detected by analyzing anomalous lookup patterns and follow-on activity. |
| DE.CM-01 — Networks and network services are monitored to find potentially adverse events | Monitoring lookup and query telemetry helps surface reconnaissance before login attempts. | |
| Recommendation — Analyze unusual identity lookup patterns as threat indicators, not as isolated user behavior. Monitor directory, portal, and identity query activity for repeated or broad-target reconnaissance. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Reviewing audit trails is essential for spotting repeated identity queries and correlated abuse. |
| SI-4 — System Monitoring | Continuous monitoring is needed to detect unusual identity search patterns and linked attack steps. | |
| AC-6 — Least Privilege | Minimizing who can query identity data reduces the attack surface for reconnaissance. | |
| Recommendation — Review audit data for repeated identity lookups and correlate them with downstream access attempts. Monitor identity systems for suspicious query volume, source reuse, and target breadth. Restrict identity-data access to the minimum set of users and services that truly need it. | ||
Practitioner Guidance
What to prioritise: Correlate identity lookups with authentication and email telemetry first. A weak signal becomes actionable when the same source also appears in phishing delivery, spray attempts, or login anomalies against the same set of users.
What to verify: Confirm whether the source had a legitimate business reason to search multiple employee identities. If it does not, treat repetition, breadth, and role-targeting as the deciding factors, not the absence of a failed login.
Common mistake: Teams often tune only for credential abuse and miss the preparatory stage. By the time the login attack starts, the adversary has already used identity data to make the attempt more credible and more targeted.
Practitioner takeaway: The most reliable detection comes from combining identity reconnaissance with the next step in the attack path, because identity harvesting by itself is often the earliest visible sign of a coming phishing or takeover campaign.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org