tfMITRE ATT&CK technique

Establish Accounts T1585

Tactic: Resource Development
Platform: PRE
Version: 1.3
Created: 01 October 2020
Last modified: 12 May 2026

Sub-techniques 30 rules across the family · 0 mapped directly to T1585 · 0 of 3 carry rules

.001Social Media Accounts0 .002Email Accounts0 .003Cloud Accounts0

Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.[1][2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups73rd pct

Threat groups73rd percentile · 70% of ATT&CK techniques have fewer threat groups attributed.

Campaigns72nd pct

Campaigns72nd percentile · 54% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 32% of ATT&CK techniques have none either.

Offense vs defense T1585

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Data component	Name	Channel
Social MediaDC0052	Persona	—
Network Traffic ContentDC0085	Network Traffic	—

Data component

Name

Channel

Social MediaDC0052

Persona

—

Network Traffic ContentDC0085

Network Traffic

—

Offense vs defense T1585

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Data component	Name	Channel
Social MediaDC0052	Persona	—
Network Traffic ContentDC0085	Network Traffic	—

Data component

Name

Channel

Social MediaDC0052

Persona

—

Network Traffic ContentDC0085

Network Traffic

—

Select	Title	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
No rules found. Try adjusting your filters.

Title

Description

Establish Accounts T1585

Establish Accounts T1585

Establish Accounts MITRE reference T1585

Offense vs defense T1585

Establish Accounts detection strategy DET0873

Detection of Establish Accounts

Log sources

Establish Accounts MITRE reference T1585

Offense vs defense T1585

Establish Accounts detection strategy DET0873

Detection of Establish Accounts

Log sources

Establish Accounts detections T1585

Establish Accounts detections T1585