tfMITRE ATT&CK technique

Social Engineering T1684

Tactic: Stealth
Platforms: Linux, macOS, Office Suite, SaaS, Windows
Version: 1.0
Created: 14 April 2026
Last modified: 12 May 2026

Sub-techniques 20 rules across the family · 0 mapped directly to T1684 · 0 of 2 carry rules

Adversaries may use social engineering techniques to influence users to take actions that result in unauthorized access, approval of changes, disclosure of sensitive information, or execution of adversary-supplied instructions (i.e., introduction of malicious payloads or software), while minimizing technical indicators.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Social Engineering MITRE reference T1684

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

ShinyHuntersG1057 ↗

Has used social engineering to demand payment from victims.1

created 2026-07-291 referenceaka UNC6240

All 1 groups for this technique

Offense vs defense T1684

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Social Engineering detection strategy DET0899

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Social Engineering

Enterprise

5 platforms

AN2033 · Office Suite

Detects suspicious inbound communications or collaboration requests followed by rapid sensitive user actions such as file sharing changes, macro enablement, OAuth consent, credential submission, or financial workflow approvals that deviate from historical relationships or normal approval patterns.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	m365:teams	External chat request or new tenant communication preceding approval activity

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ActionAfterMessageWindow	Time window between inbound communication and sensitive action
TrustedDomainAllowlist	Known legitimate vendors or partner domains
ApprovalAmountThreshold	Monetary threshold for finance workflows

AN2034 · SaaS

Detects consent grants, password resets, role changes, external sharing, or token creation shortly after user interaction with messages, invites, or help desk workflows. Emphasis is placed on unusual requester relationships, new device context, or off-hours approvals.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	saas:okta	user.account.reset_password; user.mfa.factor.activate; app.oauth2.authorize
Application Log ContentDC0038	saas:zoom	Unexpected contact interaction preceding follow-on admin requests

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
RequesterNoveltyDays	How long since requestor last interacted with user
GeoVelocityThreshold	Distance/time anomaly for follow-on login
AfterHoursDefinition	Organization-specific off-hours period

AN2035 · Windows

Detects user execution of newly received content or instructions shortly after external communication, including script launches, Office child process spawning, browser-to-script execution chains, or credential prompts followed by new logon sessions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Logon Session CreationDC0067	WinEventLog:Security	EventCode=4624, 4648
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
EmailToExecutionWindow	Time between message delivery and process launch
OfficeChildProcessAllowlist	Approved Office child process patterns
NewLogonWindow	Time after credential prompt to monitor new sessions

AN2036 · macOS

Detects user-authorized execution of downloaded content or scripts after communication prompts, including browser downloads followed by osascript, shell, or installer execution and subsequent network activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File AccessDC0055	macos:unifiedlog	Recent download opened or executed
Command ExecutionDC0064	macos:unifiedlog	Execution of osascript, sh, bash, zsh, installer, open
Network Connection CreationDC0082	NSM:Connections	Outbound connection after script or installer launch

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DownloadToExecutionWindow	Time between download and launch
InstallerParentAllowlist	Legitimate software deployment parents

AN2037 · Linux

Detects users executing commands copied from chats, tickets, or emails, including curl|bash patterns, shell script launches from temp directories, credential changes, or SSH key additions shortly after communication events.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File ModificationDC0061	auditd:PATH	odification of ~/.ssh/authorized_keys or credential files
Command ExecutionDC0064	auditd:EXECVE	execve of curl,wget,bash,sh,python with piped or remote content
Network Connection CreationDC0082	NSM:Connections	Outbound connection after script or installer launch

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
RemoteScriptExecutionPatterns	Organization-specific admin automation patterns to exclude
TicketToExecutionWindow	Time from help desk/chat event to command execution

Social Engineering detections T1684

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs