T1589.003 Employee Names

Technique: T1589.003
Tactics: Reconnaissance
Research, 90 days: 1
KEV CVEs mapped: 0
SigmaHQ rules: 0
Elastic, Splunk: 0
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1589/003

MITRE description

Adversaries may gather employee names that can be used during targeting. Employee names can be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures. Adversaries may easily gather employee names, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-15 GuidePoint GRIT: Behind the Help Desk Call: Insights from the Leaked Chats of an IT-Impersonation Extortion Crew

Detection coverage

Coverage data unavailable in this snapshot (community inventory not yet ingested).

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.