Establish Accounts
Account establishment creates online identities that can later support targeting or communications.
What it means
Account establishment creates online identities that can later support targeting or communications. A plausible profile may be constructed over time rather than at the moment of an attack.
MITRE ATT&CK catalogs this behavior as T1585, within resource development. The technique describes a behavior; assigning the label does not by itself prove an actor identity or successful compromise.
An investigation example
An unfamiliar persona builds contact relationships before sending a targeted business request.
Evidence to examine
Review account history, message content, relationship claims, and independent verification of identity and authority.
A common analytical pitfall
An old account or detailed profile is not sufficient evidence that a claimed relationship is genuine.
Response considerations
Verify sensitive requests through trusted organizational channels and preserve relevant account and message evidence without overclaiming attribution.
An account can be an operational resource
A fictional campaign uses a newly created social profile to contact employees. The profile may support credibility, communication, or delivery before any target account is compromised. Creating an account is distinct from stealing an existing account, and that difference affects the history and signals available to investigators.
An account's age and appearance are context, not proof. A new profile can be legitimate, while an old-looking profile can be fabricated or repurposed. Evaluate observed behavior, relationships, and the claims being made. Do not let a polished biography substitute for independent verification of authority.
The target organization may have limited visibility into registration on an external platform. It can still preserve messages received by its employees and review how the account interacted with business workflows. Separate what the organization directly observed from what a platform or intelligence partner reports.
Review a fictional contact sequence
Create a tabletop scenario in which a new profile introduces itself as a recruiter, shares public company details, and asks an employee to open an unusual resource. Identify which claims are verified, which are merely asserted, and which actions cross a company security boundary. Use invented identities and do not contact real people.
A defensive response can strengthen verification and reporting without treating every unfamiliar contact as malicious. If the account is reported to the platform, preserve relevant evidence and follow approved procedures. The analytical goal is to explain how the account functioned as a resource in the observed activity, while keeping account creation, deceptive use, target compromise, and actor attribution as separate conclusions.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1585: Establish Accounts