Techniques › T1684 › T1684.001
T1684.001 Impersonation
stealth — Linux, macOS, Office Suite, SaaS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
0
Sigma rules tagged attack.t1684.001
0
KEV CVEs mapped here
<p>Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims.</p><p>In many cases of business email compromise or email fraud campaigns, adversaries use impersonation to defraud victims -- deceiving them into sending money or divulging information that ultimately enables Financial Theft.</p><p>Adversaries will often also use social engineering techniques such as manipulative and persuasive language in email subject lines and body text such as
payment, request, or urgent to push the victim to act quickly before malicious activity is detected. These campaigns are often specifically targeted against people who, due to job roles and/or accesses, can carry out the adversary’s goal.</p><p>Impersonation is typically preceded by reconnaissance techniques such as Gather Victim Identity Information and Gather Victim Org Information as well as acquiring infrastructure such as email domains (i.e. Domains) to substantiate their false identity.</p><p>There is the potential for multiple victims in campaigns involving impersonation. For example, an adversary may Compromise Accounts targeting one organization which can then be used to support impersonation against other entities.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0286 Detection Strategy for Impersonation v1.0
AN0792 WindowsMonitor for anomalous email activity originating from Windows-hosted applications (e.g., Outlook) where the sending account name or display name does not match the underlying SMTP address. Detect abnormal volume of outbound messages containing sensitive keywords (e.g., 'payment', 'wire transfer') or anomalous login locations for accounts associated with email sending activity.m365:unified
SendOnBehalf/SendAs: Emails sent where the sending identity mismatches account ownership→ DC0038 Application Log ContentTunable:KeywordListGeoLocationBaselineAN0793 LinuxMonitor mail server logs (Postfix, Sendmail, Exim) for anomalous From headers mismatching authenticated SMTP identities. Detect abnormal relay attempts, spoofed envelope-from values, or large-scale outbound campaigns targeting internal users.auditd:SYSCALLexecve: Processes executing sendmail/postfix with forged headers→ DC0064 Command ExecutionApplication:MailMismatch between authenticated username and From header in email→ DC0038 Application Log ContentTunable:KnownRelayHostsAN0794 macOSMonitor Mail.app activity or unified logs for anomalous SMTP usage, including mismatches between display name and authenticated AppleID or Exchange credentials. Detect use of third-party mail utilities that attempt to send on behalf of corporate identities.macos:unifiedlogMail.app or third-party clients sending messages with mismatched From headers→ DC0038 Application Log ContentTunable:TrustedMailClientsAN0795 SaaSMonitor SaaS mail platforms (Google Workspace, M365, Okta-integrated apps) for SendAs/SendOnBehalfOf operations where the delegated permissions are unusual or newly granted. Detect impersonation attempts where adversaries configure rules to auto-forward or auto-reply with impersonated content.gcp:workspaceauditSendAs: Outbound messages with alias identities that differ from primary account→ DC0038 Application Log ContentTunable:DelegationBaselineAN0796 Office SuiteMonitor Office Suite applications (Outlook, Word mail merge, Excel macros) for abnormal automated message sending, especially when macros or scripts trigger email delivery. Detect patterns of impersonation language (urgent, payment, executive request) combined with anomalous execution of Office macros.m365:unifiedSendOnBehalf/SendAs: Office Suite initiated messages using impersonated identities→ DC0038 Application Log ContentTunable:MacroExecutionThreshold
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1684.001
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.