Before most social engineering or cloud abuse begins, the adversary creates identities of its own: a recruiter profile, a help desk tenant, a disposable mailbox or a free trial that will host a malicious app. MITRE ATT&CK T1585 Establish Accounts covers adversaries creating and cultivating accounts with services that can be used during targeting, including personas on social media and code platforms. In ATT&CK v20 it sits in Resource Development (TA0042) on the PRE platform and has three sub-techniques: T1585.001 Social Media Accounts, T1585.002 Email Accounts and T1585.003 Cloud Accounts. Because the accounts are created on services you do not control, ATT&CK's only mitigation is M1056 Pre-compromise, and its analytics push detection to the stages where those accounts touch you. This guide is for threat intelligence, SOC, identity and collaboration platform teams and shows where those touch points are and what to log. For accounts the adversary takes over rather than creates, see the MITRE ATT&CK T1586 Compromise Accounts Guide.
Key takeaways
- You detect the account when it reaches you. Creation happens outside your visibility, so the useful signals are inbound: external Teams tenants, new sender identities, recruiter approaches, job applicants and sign-ups to your own services.
- Attacker identities are increasingly non-human. ATT&CK records that the Salesforce Data Exfiltration campaign (C0059) created Salesforce trial accounts to register its malicious applications, which were then authorised into victims' tenants.
- Tenants are personas too. Storm-1811 created Microsoft tenants with display names such as "Help Desk" and "IT Support" to contact targets over Teams, so external access policy is a T1585 control.
- Personas target staff, not systems. Contagious Interview built fake LinkedIn, Telegram, email and code repository personas and job posts, which makes HR, recruiting and developers the front line.
- Hiring is an identity proofing problem. FBI guidance on North Korean IT workers stresses identity verification across hiring and employment and checking contact details reused across applicants.
How the technique works
ATT&CK describes persona development as building "public information, presence, history and appropriate affiliations" so an identity survives scrutiny. Personas may be fictitious or impersonate real people, and may span sites such as LinkedIn, GitHub and Docker Hub. Email accounts support phishing (T1566) and phishing for information (T1598) and help register other infrastructure; cloud accounts host exfiltration storage, tools (T1608.002 Upload Tool) and servers (T1583.003 Virtual Private Server). The sub-techniques differ in where you can see them:
| Sub-technique | Typical use (ATT&CK v20 examples) | Where it reaches you | Your telemetry |
|---|---|---|---|
| T1585.001 Social Media Accounts | Fake recruiter and employee profiles (Contagious Interview, Operation Dream Job); matching fake profiles supporting new accounts in victim environments (Scattered Spider) | Connection requests and messages to staff; fake job posts; impersonation of your brand or executives | Brand and executive monitoring, user reports, HR and recruiting records |
| T1585.002 Email Accounts | Freemail and privacy-mail addresses for phishing, extortion (ShinyHunters, C0059) and infrastructure registration; disposable addresses | Inbound email, sign-ups and registrar contacts | Mail gateway logs, sender reputation and first-seen sender analytics |
| T1585.003 Cloud Accounts | Tenants for Teams contact (Storm-1811), trial accounts to register malicious apps (C0059), cloud storage for exfiltration | External collaboration, OAuth consent, exfiltration destinations, sign-ups to your own SaaS | Teams and Entra ID logs, SaaS connected app events, proxy logs, your product's sign-up telemetry |
ATT&CK v20 lists Contagious Interview, Fox Kitten, Kimsuky, Ember Bear, APT17 and The Gentlemen against the parent technique, and more than 20 groups each against the social media and email sub-techniques, including Sandworm Team, Scattered Spider, APT42, Star Blizzard and ShinyHunters.
Where it shows up
- Help desk impersonation over collaboration tools: Microsoft reported Storm-1811 combining email flooding with Teams calls from attacker tenants, then persuading users to start Quick Assist, which led to malware and Black Basta ransomware. See the Email Bombing and Help Desk Impersonation over Teams Guide.
- Attacker-owned applications: in the Salesforce campaign, the trial accounts hosted connected apps, often a modified Data Loader renamed to fit the pretext, that callers persuaded staff to authorise. See the ShinyHunters Salesforce data theft analysis.
- Fake recruiters and coding tests: developer-targeted personas delivering malicious packages or repositories. See the Contagious Interview Threat Actor Profile Guide.
- Fake job applicants: fabricated candidates who become insiders. See the Insider Threat from Fake IT Workers Guide (North Korean IT Worker Schemes).
- Abuse of your own service: if you run a SaaS or cloud product, adversaries create free accounts on it for infrastructure. See the Fake Account Creation and Sign-up Fraud Guide.
Detection
The ATT&CK detection strategies for T1585 and its sub-techniques (DET0873, DET0851, DET0835 and DET0846) note that much of the activity happens outside the target's visibility and recommend focusing on related stages such as initial access and exfiltration; the social media analytic adds monitoring of personas that claim affiliation with your organisation. Practical touch points:
| Touch point | Log source | Detection logic |
|---|---|---|
| External collaboration contact | Microsoft Teams and Entra ID audit logs, Defender advanced hunting | One-to-one chats or calls from foreign tenants with help desk style display names to users who then run remote support tools; Microsoft publishes a hunting query for this pattern and a Defender alert "Suspicious activity using Quick Assist" |
| OAuth app authorisation | Salesforce Setup Audit Trail and event monitoring; Entra ID consent and service principal creation events | New connected app or multi-tenant app authorised by a user, especially one whose publisher tenant or org is unknown or newly created, followed by bulk API reads |
| New sender identities | Mail gateway | First-seen freemail or privacy-mail senders writing to finance, HR or executives; display names matching staff or suppliers |
| Persona approaches | User reports, brand monitoring | Profiles claiming employment at your organisation that HR cannot match; recruiter approaches to developers with coding tasks |
| Hiring pipeline | Applicant tracking and HR systems | Phone numbers and email addresses reused across applicants; address or payment changes during onboarding (FBI red flags) |
| Exfiltration destinations | Proxy, CASB and DLP | Uploads to personal or newly seen cloud storage accounts (T1567.002 Exfiltration to Cloud Storage) |
Measuring it
- External access posture: whether Teams external access is limited to allowlisted domains, and the number of exceptions.
- App consent control: percentage of OAuth apps in Salesforce and Entra ID that went through admin approval; unknown apps removed per quarter.
- Report rate: staff reports of suspicious recruiter, help desk or executive personas, and time to triage.
- Hiring checks: share of remote hires completing documented identity verification.
- Takedowns: impersonating profiles and domains removed, and median time to removal.
Prevention and hardening
M1056 Pre-compromise means you cannot stop account creation, only reduce what those accounts can do to you:
- Collaboration boundaries: restrict Teams external access to allowlisted partner domains where the business allows, block or warn on unmanaged accounts, and train staff to check the "External" tag, as Microsoft advises. See the Microsoft Teams Security Guide.
- Remote support tools: remove Quick Assist and unused RMM tools and use an authenticated help desk tool, per Microsoft's Storm-1811 guidance.
- App governance: restrict who can install or authorise connected apps (for example the Salesforce "Manage Connected Apps" permission), allowlist approved apps, and require admin consent in Entra ID. Keep an inventory with owner, scopes and purpose.
- Help desk verification: a callback or in-person procedure for any request to reset credentials or approve apps. See the Account Recovery and Help Desk Security Guide.
- Hiring controls: the FBI recommends identity verification at interview, onboarding and throughout employment, cross-checking applicants' contact details, auditing staffing firms and doing as much of hiring and onboarding in person as possible.
- Brand protection: monitor and take down impersonating profiles and lookalike domains. See the Brand Impersonation and Lookalike Domain Takedown Playbook.
Rollout
- Map which external identities can reach staff today: Teams federation, guest access, OAuth app consent, email, recruiting channels.
- Switch OAuth apps to admin approval in audit mode, review requests for a month, then enforce.
- Pilot Teams external access restrictions with one business unit and a documented exception process; roll back by reopening federation for that unit if partner work breaks.
- Add the touch point detections above to the SIEM and assign triage owners in SOC and HR.
- Run awareness for help desk, finance, HR and developers using the real persona patterns above.
Where identity fits
T1585 is the adversary building its own identity estate. The human-facing personas are an awareness and proofing problem, but the cloud side is a non-human identity problem for defenders: attacker trial accounts and tenants register applications, and once a user authorises one, the app's OAuth tokens give the adversary a persistent, MFA-free foothold that survives a password reset. Treat third-party app authorisations as identity grants with owners, scopes and expiry, and alert when an app from an unknown publisher appears. See the MITRE ATT&CK T1528 Steal Application Access Token Guide and the Salesforce Event Monitoring Detection Guide.
Responding when an attacker account reaches you
- Block the identity: add the external tenant or domain to the block list, block the sender, and report the account to the platform.
- Revoke what it was granted: uninstall the connected app or service principal and revoke its tokens; reset any credentials the user disclosed.
- Find other contacts: search chat, call, email and consent logs for the same tenant, sender, app ID or display name.
- Check follow-on activity: remote support sessions, bulk exports and new admin roles in the window.
- Feed intelligence: record persona names, tenants, email addresses and app names as indicators. See the Help Desk Social Engineering Incident Playbook.
Common failure patterns
- Open federation by default: any tenant can message any employee, so a "Help Desk" tenant looks internal enough.
- User consent left on: staff can authorise third-party apps without review, as the Salesforce campaign exploited.
- Recruiting outside security: HR and talent teams are not briefed on fake candidates or recruiter personas.
- Indicators not shared: persona and tenant details from one incident are not searched across other channels.
- Treating it as unobservable: teams skip T1585 because creation is external, and miss every touch point.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK v20 | T1585, T1585.001, T1585.002, T1585.003; related T1586, T1566.003, T1598, T1583, T1567.002 | Technique, sub-techniques and the stages where accounts are used |
| ATT&CK mitigations | M1056 Pre-compromise; M1017 User Training for follow-on stages | Limits of prevention; awareness |
| NIST SP 800-53 Rev. 5 | AT-2, AC-20, CA-3, IA-8, SI-4, PS-3 | Awareness, external systems, information exchange, non-organisational users, monitoring, personnel screening |
| NIST CSF 2.0 | ID.RA-03, PR.AT-01, DE.CM-09 | Threat identification, awareness, monitoring |
| CIS Controls v8.1 | Controls 9, 14 and 15 | Email and browser protections, awareness training, service provider management |
Practitioner checklist
- Restrict Teams external access to allowlisted domains where possible and alert on help desk style external display names.
- Require admin approval for OAuth and connected apps in Salesforce, Entra ID and other SaaS.
- Alert on new apps from unknown publishers followed by bulk API reads.
- Remove unused remote support tools and use an authenticated help desk tool.
- Add identity verification and applicant contact-detail cross-checks to remote hiring.
- Monitor for profiles and domains impersonating your organisation and executives.
- Brief help desk, HR, finance and developers on current persona patterns.
Standards and references
- MITRE ATT&CK: Establish Accounts (T1585)
- MITRE ATT&CK: Establish Accounts: Cloud Accounts (T1585.003)
- MITRE ATT&CK: Salesforce Data Exfiltration (C0059)
- Microsoft Threat Intelligence: Threat actors misusing Quick Assist in social engineering attacks leading to ransomware
- FBI IC3: North Korean IT Workers Conducting Data Extortion (PSA250123)
- MITRE ATT&CK: Pre-compromise (M1056)
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
Related NHI Mgmt Group resources: ATT&CK Resource Development Tactic Guide · MITRE ATT&CK T1586 Compromise Accounts Guide · Email Bombing and Help Desk Impersonation over Teams Guide · Insider Threat from Fake IT Workers Guide (North Korean IT Worker Schemes) · Fake Account Creation and Sign-up Fraud Guide