T1586.001 Social Media Accounts

Technique: T1586.001
Tactics: Resource Development
Research, 90 days: 2
KEV CVEs mapped: 0
SigmaHQ rules: 0
Elastic, Splunk: 1
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1586/001

MITRE description

Adversaries may compromise social media accounts that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating social media profiles (i.e. [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001)), adversaries may compromise existing social media accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising social media accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, or by brute forcing credentials (ex: password reuse from breach credential dumps).(Citation: AnonHBGary) Prior to compromising social media accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, etc.). Compromised social media accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries can use a compromised social media profile to create new, or hijack existing, connections to targets of interest. These connections may be direct or may include trying to connect through others.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) Compromised profiles may be leveraged during other phases of the adversary lifecycle, such as during Initial Access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-08-25 Group-IB: Balonx Sistema: El Rostro Detrás del PhaaS que Impacta la Banca Mexicana
2026-08-19 Group-IB: Balonx Sistema: The Face Behind the PhaaS Affecting Mexican Banking

Detection coverage

Elastic and Splunk rules

Windows Process Outbound Connection To Social Media Domain (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.