Gather Victim Identity Information: Employee Names `T1589.003`

Tactic: Reconnaissance

Adversaries may gather employee names that can be used during targeting. Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures.

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (3 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`CommadCount`	1	`ge` 1	`8`
`aws::userAgent`	1	`starts_with` 1	`aws-cli`
`command`	1	`contains` 1	`suspiciouscommands`

Top indicator values (3 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)
`CommadCount`	`ge`	`8` kustoAWSCloudTrail - Suspicious AWS CLI Command Execution	1
`aws::userAgent`	`starts_with`	`aws-cli` kustoAWSCloudTrail - Suspicious AWS CLI Command Execution	1
`command`	`contains`	`suspiciouscommands` kustoAWSCloudTrail - Suspicious AWS CLI Command Execution	1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: AWS

Domain: Cloud

Kusto 1 rule