T1585.002

Email Accounts

Resource Development

Adversaries may create email accounts that can be used during targeting. Accounts created with email providers — including free webmail services, privacy-focused providers, and disposable email services — are leveraged for phishing operations (T1566), phishing for information (T1598), infrastructure acquisition (T1583.001), and social engineering. Adversaries cultivate personas by pairing email accounts with social media presence to increase campaign credibility. Threat actors including Kimsuky, APT1, Magic Hound, Star Blizzard, APT42, EXOTIC LILY, CURIUM, Leviathan, and Wizard Spider have created dedicated email accounts for spearphishing, ransomware negotiations, domain registration, and target impersonation. Use of disposable services and privacy providers such as ProtonMail reduces physical attribution risk. Detection pivots on observable usage patterns when adversary-created accounts contact the organization — inbound authentication failures, role-based impersonation via free email providers, and targeting of high-value employees.

Microsoft Sentinel / Defender
kusto 
let DisposableAndAnonEmailDomains = dynamic([
    "protonmail.com", "protonmail.ch", "pm.me",
    "tutanota.com", "tutanota.de", "tutanota.org", "tuta.io", "tuta.com",
    "guerrillamail.com", "guerrillamail.net", "guerrillamail.org",
    "guerrillamail.biz", "guerrillamail.de", "guerrillamail.info",
    "grr.la", "sharklasers.com", "guerrillamailblock.com",
    "spam4.me", "trashmail.com", "trashmail.io", "trashmail.net",
    "mailnull.com", "spamgourmet.com", "yopmail.com",
    "10minutemail.com", "tempmail.com", "throwam.com",
    "mailnesia.com", "maildrop.cc", "dispostable.com",
    "discard.email", "fakeinbox.com", "mailinator.com",
    "getairmail.com", "getnada.com", "tempr.email",
    "cock.li", "airmail.cc", "danwin1210.de"
]);
let FreeEmailProviders = dynamic([
    "gmail.com", "yahoo.com", "yahoo.co.uk", "yahoo.fr",
    "outlook.com", "hotmail.com", "hotmail.co.uk", "live.com",
    "aol.com", "icloud.com", "me.com", "msn.com"
]);
let RoleImpersonationPrefixes = dynamic([
    "it-", "it_", "it.", "helpdesk", "help-desk", "help_desk",
    "support", "noreply", "no-reply", "no_reply",
    "security", "securityteam", "security-team", "security_team",
    "admin", "administrator", "sysadmin", "sys-admin",
    "billing", "payroll", "finance", "accounting", "treasury",
    "legal", "hr", "humanresources", "human-resources",
    "ceo", "cfo", "cto", "coo", "president",
    "director", "management", "executive"
]);
let HighValueRecipientKeywords = dynamic([
    "ceo", "cfo", "cto", "coo", "president", "vp", "vice-president",
    "director", "finance", "payroll", "accounting", "treasury",
    "legal", "security", "helpdesk", "it", "sysadmin", "admin"
]);
EmailEvents
| where Timestamp > ago(24h)
| where EmailDirection == "Inbound"
| extend SenderDomain = tolower(SenderFromDomain)
| extend SenderAddr = tolower(SenderFromAddress)
| extend RecipientAddr = tolower(RecipientEmailAddress)
| extend SenderLocalPart = tostring(split(SenderAddr, "@")[0])
| extend IsDisposableDomain = SenderDomain has_any (DisposableAndAnonEmailDomains)
| extend IsFreeDomain = SenderDomain has_any (FreeEmailProviders)
| extend IsRoleImpersonation = (IsDisposableDomain or IsFreeDomain)
    and SenderLocalPart has_any (RoleImpersonationPrefixes)
| extend IsHighValueTarget = RecipientAddr has_any (HighValueRecipientKeywords)
| extend AuthFailed = AuthenticationDetails has_any ("fail", "softfail", "none")
    and not (AuthenticationDetails has "pass")
| extend AuthPartialFail = AuthenticationDetails has_any ("fail", "softfail")
| extend RiskScore = toint(IsDisposableDomain) * 2
    + toint(IsRoleImpersonation) * 3
    + toint(IsHighValueTarget) * 2
    + toint(AuthFailed) * 2
    + toint(AuthPartialFail)
| where RiskScore >= 3
    or IsRoleImpersonation == true
    or (IsDisposableDomain and IsHighValueTarget)
| project
    Timestamp, SenderFromAddress, SenderDomain, SenderLocalPart,
    RecipientEmailAddress, Subject, DeliveryAction, LatestDeliveryLocation,
    ThreatTypes, DetectionMethods, AuthenticationDetails,
    IsDisposableDomain, IsFreeDomain, IsRoleImpersonation,
    IsHighValueTarget, AuthFailed, RiskScore,
    SenderIPv4, SenderIPv6, NetworkMessageId, InternetMessageId
| sort by RiskScore desc, Timestamp desc
medium severity medium confidence

Data Sources

Email: Email Message Network Traffic: Network Traffic Content Microsoft 365 Defender — EmailEvents Microsoft Defender for Office 365

Required Tables

EmailEvents

False Positives

  • Legitimate vendors or contractors who communicate via ProtonMail or other privacy-focused email providers for confidentiality reasons
  • Automated service notifications from platforms that use role-based sender names at free email providers (e.g., [email protected] for small SaaS services)
  • Job applicants submitting resumes to HR addresses using disposable email services to protect their personal address
  • Security researchers or third-party pen testers using anonymous email providers during authorized assessments — verify against active engagement records
  • International partners or small businesses that rely on free email providers due to lack of corporate email infrastructure
Last updated: 2026-04-13 Research depth: deep
References (9)

Unlock Pro Content

Get the full detection package for T1585.002 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Parent Technique

T1585Establish Accounts

Related Sub-techniques

T1585.001Social Media AccountsT1585.003Cloud Accounts

Same Tactic: Resource Development

Popular Detections