VOID MANTICOREG1055 ↗
Has gathered details on their intended victims to aid in social engineering efforts for leveraging tailored themes of attacks.1
tfMITRE ATT&CK technique
Gather Victim Identity Information T1589
- Tactic
- Reconnaissance
- Platform
- PRE
- Version
- 1.3
- Created
- 02 October 2020
- Last modified
- 12 May 2026
- Contributors
- Jannie Li, Microsoft Threat Intelligence Center (MSTIC); Obsidian Security
Sub-techniques 36 rules across the family · 2 mapped directly to T1589 · 2 of 3 carry rules
Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
10
Threat groupsTop 19%
Threat groups81st percentile · 80% of ATT&CK techniques have fewer threat groups attributed.2
CampaignsTop 17%
Campaigns83rd percentile · 73% of ATT&CK techniques have fewer campaigns recorded.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.2
Detection rules50th pct
Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.