T1586 · Compromise Accounts · MITRE ATT&CK

Offense vs defense T1586

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 1

Compromise Accounts detection strategy DET0876

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Compromise Accounts

Enterprise

1 platform

AN2008 · PRE

Consider monitoring social media activity related to your organization. Suspicious activity may include personas claiming to work for your organization or recently modified accounts making numerous connection requests to accounts affiliated with your organization. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: Phishing). Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Social MediaDC0052	Persona	—
Network Traffic ContentDC0085	Network Traffic	—

Compromise Accounts detections T1586

3 rules are mapped to this technique.

54th pctamong all ATT&CK techniques for number of rules

Showing 1-3 of 3 rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	The following analytic detects an AWS account successfully authenticating from multiple unique IP addresses within a 5-minute window. (...)	Anomaly	stable	authentication	-	AWS CloudTrail · AWS	Resource Development Compromise Accounts Stealth Unused/Unsupported Cloud Regions	-	medium	Bhavin Patel, Splunk	2023-01-19	2026-05-13	395e50e1-2b87-4fa3-8632-0dfbdcbcd2cb
	Detects unauthorized access attempts to a resource.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Resource Development Compromise Accounts	-	critical	Muhammad Faisal (@faisalusuf)	2024-02-25	—	7215374a-de4f-4b33-8ba5-70804c9251d3
	Detects when full data export is attempted an unauthorized user.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Resource Development Compromise Accounts Collection Data from Information Repositories Code Repositories	-	critical	Muhammad Faisal (@faisalusuf)	2024-02-25	—	34d81081-03c9-4a7f-91c9-5e46af625cde

Compromise Accounts T1586

Compromise Accounts T1586

Offense vs defense T1586

Compromise Accounts detection strategy DET0876

Detection of Compromise Accounts

Log sources

Offense vs defense T1586

Compromise Accounts detection strategy DET0876

Detection of Compromise Accounts

Log sources

Compromise Accounts detections T1586

Compromise Accounts detections T1586