Gather victim identity information (T1589)

What is gather victim identity information (T1589)?

Gather victim identity information is a MITRE ATT&CK® reconnaissance technique in which adversaries collect identity-related data about target organization personnel before initiating an intrusion. Unlike active techniques that probe an organization's infrastructure directly, T1589 is entirely passive. Adversaries aggregate identity data from public and semi-public sources including breach credential repositories, corporate websites, LinkedIn profiles, job postings, and email format enumeration, without generating any traffic that the target organization can observe.

The identity data harvested through T1589 directly enables two downstream attack vectors: credential-based initial access using T1078 (valid accounts), where harvested username-password pairs from breach databases are tested against the organization's authentication endpoints. The second is highly targeted spear-phishing via T1566, where employee names, roles, and organizational hierarchy inform convincing pretexts. Understanding these downstream risks is core to any MITRE ATT&CK framework detection strategy. This is why detecting T1589 has operational security value even though the collection itself is invisible. The downstream authentication anomalies that follow credential testing are detectable, and catching them early limits the window between credential harvesting and successful intrusion.

How attackers harvest identity data

T1589 identity reconnaissance uses a layered approach, combining automated tools with manual open source intelligence techniques to build a comprehensive identity dossier before engaging the target:

1. Credential breach databases: Repositories such as Have I Been Pwned, LeakBase, RaidForums, and dark web credential markets contain billions of email-password combinations from past data breaches. Attackers query these sources against target email domains (e.g., @company.com) to instantly obtain a list of employee credentials with previously used passwords. Even if passwords have been changed, older breach passwords are tested first as many users recycle passwords with minor variations. Organizations can reduce exposure by enabling dark web monitoring to receive alerts when employee credentials appear in breach repositories.
2. Email enumeration: Attackers enumerate valid email addresses by probing SMTP servers (RCPT TO enumeration), using Microsoft 365's user enumeration endpoint behavior, querying email verification APIs, and analyzing patterns in publicly disclosed addresses (first.last@company.com vs first_last@company.com). A confirmed email format and valid address list enables both credential testing and targeted phishing attack campaigns.
3. LinkedIn and professional networks: LinkedIn provides adversaries with an organizational hierarchy, employee roles, tenure, technical skills (revealing what software the organization uses), and contact information, all without triggering any target-side detection. Adversaries build employee target lists for executive impersonation, social engineering pretext construction, and identifying which accounts would have the highest-value access if compromised.
4. Corporate websites and job postings: "About us" pages and job postings reveal technology stack (job descriptions mention specific software versions), team structures, and operational processes. A job posting for "Splunk administrator" confirms the technology stack that can be used for targeted phishing pretexts or CVE-based initial access planning.
5. GitHub and code repositories: Public repositories containing organization code often expose hardcoded credentials, API keys, internal endpoint URLs, and employee email addresses in commit history. GitHub organization members and contributor lists reveal developer identity and potentially their access levels within the organization's systems.

Sub-techniques

MITRE ATT&CK documents three T1589 sub-techniques representing distinct categories of identity data collection. Each sub-technique maps to specific downstream attack TTPs tracked in the MITRE ATT&CK and MITRE D3FEND frameworks:

• T1589.001 — Credentials: Harvesting valid username-password pairs or password hashes from data breach repositories, dark web markets, and credential dumping services. The harvested credentials are then tested against authentication endpoints (VPN, cloud portals, email) in credential stuffing campaigns. This sub-technique has the most direct and immediate impact on organizational security: a single valid credential pair can provide immediate initial access if MFA is not enforced.
• T1589.002 — Email Addresses: Enumerating valid email addresses within the target organization through SMTP probing, Microsoft 365 user enumeration, and pattern inference from disclosed employee emails. A confirmed list of valid organizational email addresses enables targeted phishing, BEC campaigns, and provides the username component for credential testing. Email harvesting can be performed entirely through legitimate Microsoft 365 API behavior that does not require authentication.
• T1589.003 — Employee Names: Collecting employee names, roles, organizational positions, and reporting relationships from LinkedIn, company websites, conference speaker lists, and professional publications. This identity mapping is the foundation for executive impersonation attacks, social engineering pretexts, insider threat simulation, and identifying which accounts represent the highest-value compromise targets based on their role and system access.

Detection approach

T1589 identity collection occurs entirely outside organizational infrastructure, making direct SIEM detection of the collection phase impossible. The detection strategy focuses on the operational use of harvested identity data: the authentication events, MFA failures, and anomalous sign-ins that indicate collected credentials are being weaponized:

Authentication failure burst detection

Credential stuffing using breach data produces a characteristic authentication event pattern: a high volume of failed logon attempts across multiple different accounts within a compressed time window, originating from a small number of source IPs. Unlike a brute force attack (T1110) that tries many passwords against one account, credential stuffing tests known passwords across many accounts. Log360's account lockout correlation rules and multi-account failure threshold rules detect this pattern across Windows (Event ID 4625, 4740) and Microsoft 365 authentication events.

MFA failure and bypass pattern detection

When harvested credentials include valid current passwords, attackers will present correct password authentication but fail MFA challenges. A pattern of successful password authentication immediately followed by MFA failure, particularly from unusual locations or new devices, indicates that breach data contains valid current passwords for your organization. Log360's M365 rules specifically target MFA Challenge Failed During Authentication and Risky Sign-in with Device Registration, which surface this pattern.

First-seen location and device anomaly detection

Breach credential use frequently comes from attacker-controlled infrastructure (VPS, residential proxies, Tor exit nodes) with geographic origins inconsistent with the legitimate user's authentication history. Log360's user behavior analytics and behavioral baseline capabilities detect first-seen-country and first-seen-device sign-in events that represent high-probability indicators of harvested credential use, separate from failed authentication events where the attacker has the correct current password. Anomaly detection in these sign-in patterns provides a critical secondary detection layer beyond threshold-based rules.

Email account enumeration probe detection

Microsoft 365 sign-in logs surface invalid username attempts: authentication requests to email addresses that do not exist in the tenant. A burst of sign-in attempts for non-existent usernames with no corresponding password attempts indicates T1589.002 email address enumeration against the M365 tenant, as attackers probe to confirm which email pattern variations (first.last vs flast vs f.last) return valid vs invalid user errors.

Log360 detection capabilities

Log360 detects T1589 downstream weaponization through authentication event monitoring across Windows, Active Directory, and Microsoft 365 environments:

Investigation steps

When authentication anomaly rules surface a potential T1589 downstream event, the investigation goal is to determine whether harvested credentials have been successfully used and what access the attacker has obtained:

1. Profile the authentication source: Identify the source IP addresses generating the authentication failures. Enrich with Log360's threat intelligence integration: known VPN exit nodes, residential proxy networks, and credential-testing services operate from identifiable IP ranges. A source IP on threat intel lists combined with multi-account authentication failures is a near-certain credential stuffing indicator. Geolocate the source and compare against the target accounts' typical authentication locations.
2. Identify which accounts were targeted: Extract the complete list of accounts that received failed authentication attempts from the implicated source. Determine whether any accounts produced a successful authentication after the failure burst; a successful sign-in from the same source IP that was generating failures indicates at least one valid credential pair from the breach data. Immediately isolate any successfully authenticated accounts for investigation.
3. Assess the successful authentication scope: For any account that authenticated successfully from the suspicious source, review all activity in the post-authentication session: emails accessed, files downloaded, M365 applications used, Azure resource access, and any administrative actions. This establishes the blast radius of the credential compromise before any response action. Use Log360's threat investigation workflows to correlate these events into a unified incident timeline.
4. Check for MFA enrollment manipulation: Attackers with valid credentials will often attempt to modify MFA enrollment to add an attacker-controlled phone number or authenticator app. Review MFA method changes, conditional access policy assignments, and authentication method administrator actions for all targeted accounts in the 24-hour period following the credential stuffing event.
5. Review pre-authentication email activity: T1589 email enumeration (T1589.002) against M365 generates failed sign-in events with the error code AADSTS50034 (user account does not exist). Review M365 sign-in logs for clusters of non-existent username attempts that preceded the credential stuffing activity, confirming that T1589.002 email enumeration was used to validate the target account list before credential testing began.

Response playbook

• Block and rate-limit identified stuffing sources: Add confirmed credential stuffing source IPs to perimeter block lists and configure authentication endpoint rate limiting. For M365 tenants, implement conditional access policies that require compliant device status or location restrictions for authentication from unknown geographic regions, neutralizing future credential stuffing from attacker-controlled infrastructure.
• Force password reset for all targeted accounts: All accounts that received failed authentication attempts from the stuffing source should be treated as potentially exposed. Force password resets to invalidate the breach data credentials, even for accounts that did not authenticate successfully. Combine with a notification to affected users explaining the credential use policy required after a potential breach exposure event.
• Enforce MFA universally: Credential stuffing attacks are neutralized by MFA. For any accounts that do not have MFA enrolled, treat this event as the forcing function for immediate MFA enrollment. Configure Log360 alerting on any authentication events reaching password-authenticated-only acceptance states (successful password auth, no MFA required) as a policy compliance monitoring signal.
• Review breach exposure for the organization's email domain: Immediately after a T1589 downstream event, query breach notification services (Have I Been Pwned Enterprise, BreachDirectory) for the organization's email domain to identify which employee email addresses appear in known breach datasets. Prioritize password reset and MFA hardening for accounts confirmed in breach data over those with no known exposure.
• Conduct threat hunt for successful intrusions: Authentication failure bursts may accompany successful authentications that did not trigger threshold rules (e.g., if the attacker tested credentials slowly over days rather than in a burst). Proactive threat hunting for credential misuse indicators across the preceding 30 days is essential for identifying valid credential uses that predated the bulk testing event that triggered the alert.
• Implement conditional access hardening: For M365 environments, configure Entra ID Conditional Access policies requiring compliant device status, named location restrictions for administrative accounts, and sign-in frequency policies that limit session persistence for accounts accessed from unrecognized devices. Pair this with a structured incident response plan that defines escalation paths for confirmed credential compromise events. These controls significantly raise the friction for T1589 downstream credential use even when valid passwords are possessed.

Need to explore ManageEngine Log360? Schedule a personalized demo

Frequently asked questions