TeamPCPG1056 ↗
Impersonated legitimate maintainers to push imposter commits to the Aquasecurity Trivy scanner GitHub repository.12
- Tactic
- Stealth
- Platforms
- Linux, macOS, Office Suite, SaaS, Windows
- Version
- 1.0
- Created
- 14 April 2026
- Last modified
- 12 May 2026
- Contributors
- Blake Strom, Microsoft Threat Intelligence; Pawel Partyka, Microsoft Threat Intelligence
Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
16
Threat groupsTop 11%
Threat groups89th percentile · 89% of ATT&CK techniques have this many threat groups attributed or fewer.3
CampaignsTop 12%
Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.2
Tools & malware51st pct
Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Impersonation MITRE reference T1684.001
Top 11%of all ATT&CK techniques for number of groups
16 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
VOID MANTICOREG1055 ↗
Has impersonated individuals familiar to the victim and technical support associated with social messaging services.1
MirrorFaceG1054 ↗
Has sent targeted emails purporting to be from a Japanese political party’s PR department.1
Contagious InterviewG1052 ↗
Had impersonated HR hiring personnel through social media, job board notifications, and conducted interviews with victims in order to entice them to download malware disguised as legitimate applications or malicious scripts from code repositories.12345678
Storm-1811G1046 ↗
Impersonates help desk and IT support personnel for phishing and social engineering purposes during initial access to victim environments.1
APT42G1044 ↗
Has impersonated legitimate people in phishing emails to gain credentials.12
All 16 groups for this technique · 6 newest in this preview
3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
C0027C0027 ↗
During C0027, Scattered Spider impersonated legitimate IT personnel in phone calls and text messages either to direct victims to a credential harvesting site or getting victims to run commercial remote monitoring and management (RMM) tools.1
Operation Dream JobC0022 ↗
During Operation Dream Job, Lazarus Group impersonated HR hiring personnel through LinkedIn messages and conducted interviews with victims in order to deceive them into downloading malware.123
Salesforce Data ExfiltrationC0059 ↗
During Salesforce Data Exfiltration, threat actors impersonated IT support personnel in voice calls with victims at times claiming to be addressing enterprise-wide connectivity issues.12
All 3 campaigns for this technique
2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
RustyWaterS9037 ↗
Has impersonated TMCell (Altyn Asyr CJSC), the primary mobile operator in Turkmenistan, sending phishing emails with the email domain info@tmcell.1
NPPSPYS1131 ↗
Creates a network listener using the misspelled label logincontroll recorded to the Registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\NetworkProvider\\Order.1
All 2 software entries for this technique
Offense vs defense T1684.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Impersonation detection strategy DET0286
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Impersonation
5 platforms
AN0792 · Windows
Monitor for anomalous email activity originating from Windows-hosted applications (e.g., Outlook) where the sending account name or display name does not match the underlying SMTP address. Detect abnormal volume of outbound messages containing sensitive keywords (e.g., 'payment', 'wire transfer') or anomalous login locations for accounts associated with email sending activity.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | m365:unified | SendOnBehalf/SendAs: Emails sent where the sending identity mismatches account ownership |
| Logon Session CreationDC0067 | WinEventLog:Security | EventCode=4624, 4648 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| KeywordList | Adjust impersonation detection keywords based on local business risk terms (e.g., 'ACH', 'Invoice'). |
| GeoLocationBaseline | Define trusted geographic regions for normal user email activity. |
AN0793 · Linux
Monitor mail server logs (Postfix, Sendmail, Exim) for anomalous From headers mismatching authenticated SMTP identities. Detect abnormal relay attempts, spoofed envelope-from values, or large-scale outbound campaigns targeting internal users.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | Application:Mail | Mismatch between authenticated username and From header in email |
| Command ExecutionDC0064 | auditd:SYSCALL | execve: Processes executing sendmail/postfix with forged headers |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| KnownRelayHosts | Filter trusted relays or automated notification systems from impersonation alerts. |
AN0794 · macOS
Monitor Mail.app activity or unified logs for anomalous SMTP usage, including mismatches between display name and authenticated AppleID or Exchange credentials. Detect use of third-party mail utilities that attempt to send on behalf of corporate identities.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | macos:unifiedlog | Mail.app or third-party clients sending messages with mismatched From headers |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TrustedMailClients | Allowlist known third-party clients used for legitimate email activity. |
AN0795 · SaaS
Monitor SaaS mail platforms (Google Workspace, M365, Okta-integrated apps) for SendAs/SendOnBehalfOf operations where the delegated permissions are unusual or newly granted. Detect impersonation attempts where adversaries configure rules to auto-forward or auto-reply with impersonated content.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | gcp:workspaceaudit | SendAs: Outbound messages with alias identities that differ from primary account |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DelegationBaseline | Maintain baseline of normal SendAs/SendOnBehalf relationships to reduce false positives. |
AN0796 · Office Suite
Monitor Office Suite applications (Outlook, Word mail merge, Excel macros) for abnormal automated message sending, especially when macros or scripts trigger email delivery. Detect patterns of impersonation language (urgent, payment, executive request) combined with anomalous execution of Office macros.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | m365:unified | SendOnBehalf/SendAs: Office Suite initiated messages using impersonated identities |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MacroExecutionThreshold | Threshold for correlating macro execution with email sending activity. |
Threat intelligence helps defenders and users be aware of and defend against common lures and active campaigns that have been used for impersonation.
User TrainingM1017
Train users to be aware of impersonation tricks and how to counter them, for example confirming incoming requests through an independent platform like a phone call or in-person, to reduce risk.