T1684.001 Social Engineering: Impersonation — cross-source coverage

From MITRE ATT&CK 19.2

Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims.

In many cases of business email compromise or email fraud campaigns, adversaries use impersonation to defraud victims -- deceiving them into sending money or divulging information that ultimately enables Financial Theft.

Adversaries will often also use social engineering techniques such as manipulative and persuasive language in email subject lines and body text such as payment, request, or urgent to push the victim to act quickly before malicious activity is detected. These campaigns are often specifically targeted against people who, due to job roles and/or accesses, can carry out the adversary’s goal.  

Impersonation is typically preceded by reconnaissance techniques such as Gather Victim Identity Information and Gather Victim Org Information as well as acquiring infrastructure such as email domains (i.e. Domains) to substantiate their false identity.

There is the potential for multiple victims in campaigns involving impersonation. For example, an adversary may Compromise Accounts targeting one organization which can then be used to support impersonation against other entities.

Tactics

Stealth

Platforms

Linux · macOS · Office Suite · SaaS · Windows

Telemetry

WinEventLog:Securitym365:unifiedauditd:SYSCALLApplication:Mailmacos:unifiedloggcp:workspaceaudit

How MITRE says to detect it DET0286

Detection Strategy for Impersonation

Windows Analytic 0792

Monitor for anomalous email activity originating from Windows-hosted applications (e.g., Outlook) where the sending account name or display name does not match the underlying SMTP address. Detect abnormal volume of outbound messages containing sensitive keywords (e.g., 'payment', 'wire transfer') or anomalous login locations for accounts associated with email sending activity.

WinEventLog:Security EventCode=4624, 4648
m365:unified SendOnBehalf/SendAs: Emails sent where the sending identity mismatches account ownership

Linux Analytic 0793

Monitor mail server logs (Postfix, Sendmail, Exim) for anomalous From headers mismatching authenticated SMTP identities. Detect abnormal relay attempts, spoofed envelope-from values, or large-scale outbound campaigns targeting internal users.

auditd:SYSCALL execve: Processes executing sendmail/postfix with forged headers
Application:Mail Mismatch between authenticated username and From header in email

macOS Analytic 0794

Monitor Mail.app activity or unified logs for anomalous SMTP usage, including mismatches between display name and authenticated AppleID or Exchange credentials. Detect use of third-party mail utilities that attempt to send on behalf of corporate identities.

macos:unifiedlog Mail.app or third-party clients sending messages with mismatched From headers

SaaS Analytic 0795

Monitor SaaS mail platforms (Google Workspace, M365, Okta-integrated apps) for SendAs/SendOnBehalfOf operations where the delegated permissions are unusual or newly granted. Detect impersonation attempts where adversaries configure rules to auto-forward or auto-reply with impersonated content.

gcp:workspaceaudit SendAs: Outbound messages with alias identities that differ from primary account

Office Suite Analytic 0796

Monitor Office Suite applications (Outlook, Word mail merge, Excel macros) for abnormal automated message sending, especially when macros or scripts trigger email delivery. Detect patterns of impersonation language (urgent, payment, executive request) combined with anomalous execution of Office macros.

m365:unified SendOnBehalf/SendAs: Office Suite initiated messages using impersonated identities