// MITRE ATT&CK
T1589.003 · Employee Names
Sub-technique of T1589 · Gather Victim Identity Information.
Adversaries may gather employee names that can be used during targeting. Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures. Adversaries may easily gather employee names, since they may be readily available and e...
How to detect & mitigate it
Detecting Employee Names starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.
Related techniques
T1592
Gather Victim Host Information T1596.003
Digital Certificates T1597.002
Purchase Technical Data T1590.005
IP Addresses T1590.002
DNS T1682
Query Public AI Services T1596.002
WHOIS T1594
Search Victim-Owned Websites
Gather Victim Host Information T1596.003
Digital Certificates T1597.002
Purchase Technical Data T1590.005
IP Addresses T1590.002
DNS T1682
Query Public AI Services T1596.002
WHOIS T1594
Search Victim-Owned Websites
Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.