Which SIEM platforms have a T1585 detection rule?

df00tech provides T1585 (Establish Accounts) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Establish Accounts (T1585)?

Detecting Establish Accounts requires the following data sources: Microsoft Defender for Office 365.

What severity and confidence is the T1585 detection?

The T1585 detection is rated medium severity with medium confidence.

What are common false positives for T1585?

Common false positives for T1585 include: Legitimate mass newsletters or marketing emails from Gmail/Yahoo senders — filter by adding known sender domains to allowlist; Corporate recruitment contacts from candidates using personal email accounts targeting HR or hiring managers; External security researchers or vendors using ProtonMail for legitimate privacy reasons contacting security teams.

T1585 IBM QRadar · QRadar

Detect Establish Accounts in IBM QRadar

This detection identifies observable indicators of adversary account establishment activity within the target environment — specifically inbound communications from newly created or privacy-focused email accounts targeting multiple employees, suspicious authentication attempts from externally established personas, and endpoint connections to account creation infrastructure. Since T1585 is a PRE-ATT&CK technique occurring outside the victim network, detections focus on the downstream effects: spearphishing precursor activity from zero-history email accounts, bulk contact campaigns from free/disposable email providers, and network telemetry showing corporate endpoints researching persona-associated platforms. Coverage spans all three sub-techniques: social media (T1585.001), email (T1585.002), and cloud account (T1585.003) establishment.

MITRE ATT&CK

Tactic: Resource Development
Technique: T1585 Establish Accounts
Canonical reference: https://attack.mitre.org/techniques/T1585/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
    "Email Sender" AS sender_address,
    LOWER(SUBSTRING("Email Sender", LOCATE('@', "Email Sender") + 1, LENGTH("Email Sender"))) AS sender_domain,
    COUNT(*) AS email_count,
    COUNT(DISTINCT "Email Recipient") AS targeted_users,
    SUM(CASE WHEN "Email Has Attachment" ILIKE 'true' OR LONG(COALESCE("Attachment Count", '0')) > 0 THEN 1 ELSE 0 END) AS attachment_emails,
    SUM(CASE WHEN LONG(COALESCE("URL Count", '0')) > 0 THEN 1 ELSE 0 END) AS link_emails,
    DATEFORMAT(MIN(starttime), 'yyyy-MM-dd HH:mm:ss') AS first_contact,
    DATEFORMAT(MAX(starttime), 'yyyy-MM-dd HH:mm:ss') AS last_contact,
    ROUND((LONG(MAX(starttime)) - LONG(MIN(starttime))) / 3600, 1) AS campaign_duration_hours,
    CASE WHEN LOWER(SUBSTRING("Email Sender", LOCATE('@', "Email Sender") + 1, LENGTH("Email Sender"))) IN
         ('protonmail.com','proton.me','tutanota.com','tutamail.com','cock.li',
          'disroot.org','riseup.net','mailfence.com','guerrillamail.com',
          'temp-mail.org','mailinator.com','10minutemail.com','throwam.com','yopmail.com')
    THEN 1 ELSE 0 END AS is_privacy_provider,
    LOGSOURCENAME(logsourceid) AS log_source
FROM events
WHERE
    LOGSOURCETYPEID IN (143, 352, 387, 433)
    AND (
        "Email Direction" ILIKE 'inbound'
        OR "Message Direction" ILIKE 'inbound'
        OR devicedirection = 1
    )
    AND starttime >= DATEADD('day', -14, now())
    AND (
        "Email Sender" ILIKE '%@protonmail.com'
        OR "Email Sender" ILIKE '%@proton.me'
        OR "Email Sender" ILIKE '%@tutanota.com'
        OR "Email Sender" ILIKE '%@tutamail.com'
        OR "Email Sender" ILIKE '%@cock.li'
        OR "Email Sender" ILIKE '%@disroot.org'
        OR "Email Sender" ILIKE '%@riseup.net'
        OR "Email Sender" ILIKE '%@mailfence.com'
        OR "Email Sender" ILIKE '%@guerrillamail.com'
        OR "Email Sender" ILIKE '%@temp-mail.org'
        OR "Email Sender" ILIKE '%@mailinator.com'
        OR "Email Sender" ILIKE '%@10minutemail.com'
        OR "Email Sender" ILIKE '%@throwam.com'
        OR "Email Sender" ILIKE '%@yopmail.com'
        OR "Email Sender" ILIKE '%@gmail.com'
        OR "Email Sender" ILIKE '%@yahoo.com'
        OR "Email Sender" ILIKE '%@hotmail.com'
        OR "Email Sender" ILIKE '%@outlook.com'
        OR "Email Sender" ILIKE '%@live.com'
        OR "Email Sender" ILIKE '%@icloud.com'
        OR "Email Sender" ILIKE '%@aol.com'
    )
GROUP BY
    sender_address, sender_domain, is_privacy_provider, log_source
HAVING
    COUNT(*) >= 2
    AND COUNT(DISTINCT "Email Recipient") >= 2
    AND (
        COUNT(DISTINCT "Email Recipient") >= 10
        OR (COUNT(DISTINCT "Email Recipient") >= 5 AND COUNT(*) >= 3)
        OR (
            LOWER(SUBSTRING("Email Sender", LOCATE('@', "Email Sender") + 1, LENGTH("Email Sender"))) IN
            ('protonmail.com','proton.me','tutanota.com','tutamail.com','cock.li','disroot.org',
             'riseup.net','mailfence.com','guerrillamail.com','temp-mail.org','mailinator.com','yopmail.com')
            AND COUNT(DISTINCT "Email Recipient") >= 2
        )
    )
ORDER BY targeted_users DESC

medium severity medium confidence

QRadar AQL detection for inbound multi-recipient email campaigns from privacy or free email providers over a 14-day lookback window. LOGSOURCETYPEID values target Microsoft Exchange (143), Microsoft Office 365 (352), Proofpoint Protection Server (387), and Mimecast (433) — verify actual IDs in your QRadar deployment via Admin > Log Source Management. Custom Event Properties 'Email Sender', 'Email Recipient', 'Email Direction', 'Email Has Attachment', 'URL Count', and 'Attachment Count' must be defined and mapped via DSM Editor or Log Source Extension. The HAVING clause encodes the key thresholds from the risk scoring model: privacy provider + 2+ recipients, or 5+ recipients from any provider, or 10+ recipients unconditionally. For full per-event risk scoring, chain this base query into a QRadar Custom Rule or Rule Response Limiter that applies the weighted score logic.

Data Sources

Microsoft Exchange ServerMicrosoft Office 365 Management Activity APIProofpoint Protection ServerMimecast Secure Email Gateway

Required Tables

events

False Positives & Tuning

Bulk recruitment outreach from talent acquisition platforms routing through Gmail or Outlook relay addresses, contacting multiple hiring managers simultaneously within the HAVING threshold window
Automated SaaS notification services that send operational alerts from a fixed free-provider address to multiple on-call or ops team recipients on a recurring schedule
External newsletter subscriptions forwarded internally via an email gateway rule, causing one external sender address to appear to target multiple internal recipients within a short burst window

Download portable Sigma rule (.yml)

Other platforms for T1585

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Simulate Persona-Based Inbound Email Campaign from Privacy Provider
Expected signal: EmailEvents table in Microsoft Defender for Office 365 should show matching records; Message Trace output confirms telemetry is flowing for privacy-provider senders
Test 2Test Network Detection for Social Media Account Registration Activity
Expected signal: Sysmon Event ID 22 (DNS Query) for registration domains; DeviceNetworkEvents ConnectionSuccess/ConnectionAttempted events for HTTPS connections to signup paths
Test 3Simulate Cloud Account Creation for Persona Infrastructure (Azure CLI)
Expected signal: AuditLogs in Azure AD / Microsoft Sentinel: Operation=Add application or Invite external user, Category=ApplicationManagement or UserManagement. CloudAppEvents table should show account creation activity.

Last updated: 2026-04-13 Research depth: deep

References (8)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1585 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Establish Accounts in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1585

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Sub-techniques (3)

Related Techniques

Same Tactic: Resource Development

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1585

Testing Methodology

Unlock Pro Content

Related Detections

Sub-techniques (3)

Related Techniques

Same Tactic: Resource Development

Popular Detections

Get new detections in your inbox