Which SIEM platforms have a T1589.003 detection rule?

df00tech provides T1589.003 (Employee Names) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Employee Names (T1589.003)?

Detecting Employee Names requires the following data sources: Network Traffic: Network Traffic Content, Application Log: Application Log Content, Process: Process Creation, Microsoft Defender for Endpoint, WAF / Proxy / Next-Generation Firewall (CommonSecurityLog).

What severity and confidence is the T1589.003 detection?

The T1589.003 detection is rated medium severity with low confidence.

What are common false positives for T1589.003?

Common false positives for T1589.003 include: Search engine crawlers (Googlebot, Bingbot, AhrefsBot, Semrush) legitimately indexing public team and leadership pages at high rates; SEO audit tools (Screaming Frog, Sitebulb, DeepCrawl) run by the marketing team performing scheduled site health checks; Authorized penetration testers or red team operators conducting OSINT reconnaissance during an engagement — always verify active SOW coverage.

T1589.003 Google Chronicle · YARA-L

Detect Employee Names in Google Chronicle

Adversaries may gather employee names that can be used during targeting. Employee names can be used to derive email addresses as well as to help guide other reconnaissance efforts and craft more-believable lures. Adversaries may easily gather employee names since they may be readily available and exposed via online or other accessible data sets such as social media, LinkedIn, corporate websites, and press releases. Real-world threat actors including Kimsuky, Sandworm Team, and Silent Librarian have been observed collecting victim employee name information to support subsequent phishing campaigns, credential attacks, and social engineering operations. Detection is inherently challenging because this activity primarily occurs outside the victim's environment on public platforms. Effective detection pivots to monitoring organization-owned web properties for automated scraping, tracking OSINT tool execution on monitored endpoints, and identifying downstream artifacts such as systematic user enumeration via authentication systems.

MITRE ATT&CK

Tactic: Reconnaissance
Technique: T1589 Gather Victim Identity Information
Sub-technique: T1589.003 Employee Names
Canonical reference: https://attack.mitre.org/techniques/T1589/003/

YARA-L Detection Query

Google Chronicle (YARA-L)

yaral

// ── Rule 1: OSINT harvesting tool execution (deploy this rule) ──────────────
rule employee_name_harvesting_osint_tools_t1589_003 {
  meta:
    author          = "Argus Detection Engineering"
    description     = "Detects T1589.003: execution of known OSINT employee-harvesting tools on managed endpoints"
    mitre_tactic    = "TA0043"
    mitre_technique = "T1589.003"
    severity        = "HIGH"
    confidence      = "HIGH"
    version         = "1.0"
    created         = "2026-04-13"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    (
      re.regex($proc.target.process.command_line,
        `(?i)(theHarvester|recon\-ng|CrossLinked|linkedin2username|phonebook\.cz|SpiderFoot|spiderfoot|maltego)`)
      or re.regex($proc.target.process.file.full_path,
        `(?i)(theHarvester|crosslinked|linkedin2username|recon-ng)`)
      or (
        re.regex($proc.target.process.file.full_path, `(?i)python[23]?(\.exe)?$`)
        and re.regex($proc.target.process.command_line, `(?i)(linkedin|harvest|employee|osint)`)
      )
    )

  match:
    $proc.principal.hostname over 1h

  outcome:
    $event_count    = count_distinct($proc.metadata.id)
    $commands_run   = array($proc.target.process.command_line)
    $host           = array($proc.principal.hostname)
    $user           = array($proc.principal.user.userid)

  condition:
    #proc > 0
}

// ── Rule 2: Web directory scraping via HTTP telemetry (deploy separately) ────
rule employee_directory_scraping_t1589_003 {
  meta:
    author          = "Argus Detection Engineering"
    description     = "Detects T1589.003: automated scraping of corporate employee directory web pages via HTTP/proxy telemetry"
    mitre_tactic    = "TA0043"
    mitre_technique = "T1589.003"
    severity        = "MEDIUM"
    confidence      = "MEDIUM"
    version         = "1.0"
    created         = "2026-04-13"

  events:
    $web.metadata.event_type = "NETWORK_HTTP"
    re.regex($web.target.url,
      `(?i)\/(team|about-us|about|staff|employees|directory|people|our-team|leadership|management|bios|meet-the-team|board|partners)([\/?#]|$)`)
    $web.principal.ip != ""

  match:
    $web.principal.ip over 5m

  outcome:
    $request_count = count_distinct($web.metadata.id)
    $unique_pages  = count_distinct($web.target.url)
    $sample_urls   = array($web.target.url)
    $dest_host     = array($web.target.hostname)

  condition:
    #web > 25
}

high severity medium confidence

Two Chronicle YARA-L 2.0 rules detecting employee name harvesting (T1589.003). Rule 1 targets PROCESS_LAUNCH UDM events and uses re.regex() to match known OSINT tool names and command-line patterns (theHarvester, recon-ng, CrossLinked, linkedin2username, SpiderFoot, maltego) including Python-invoked variants; grouped by principal.hostname over 1 hour, fires on any match. Rule 2 targets NETWORK_HTTP UDM events from proxy/NGFW ingestion and uses re.regex() against target.url to match corporate employee directory path patterns; grouped by principal.ip over 5 minutes, fires when >25 matching requests are observed. Deploy both rules independently in the Chronicle Rules Engine.

Data Sources

Chronicle UDM — PROCESS_LAUNCH events (Endpoint Detection via Chronicle Forwarder or CrowdStrike/Carbon Black feed)Chronicle UDM — NETWORK_HTTP events (proxy/NGFW logs via Chronicle Forwarder: Zscaler, Palo Alto, Bluecoat)Google Cloud Armor WAF logs forwarded to Chronicle

Required Tables

UDM PROCESS_LAUNCHUDM NETWORK_HTTP

False Positives & Tuning

Authorized threat intelligence or security research analysts using theHarvester or Maltego on company-managed endpoints for sanctioned external attack surface mapping — validate against approved tooling registry and user context
Third-party marketing analytics or investor relations tools accessing company team/leadership pages at scale for content monitoring or PR tracking — identify by consistent service account or known vendor IP ranges
Corporate intranet crawlers or search indexers (e.g. SharePoint indexer, Elasticsearch site crawler) that recursively index public web properties and hit staff bios or leadership pages at elevated rates

Download portable Sigma rule (.yml)

Other platforms for T1589.003

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1theHarvester Employee Name and Email Enumeration
Expected signal: Sysmon Event ID 1 (Linux auditd equivalent): process creation for 'theHarvester' or 'python3' with command line arguments '-d example.com -b google'. Sysmon Event ID 3 / auditd SYSCALL: outbound network connections to Google APIs and search endpoints. Sysmon Event ID 11: creation of /tmp/harvest_output.json. On Windows endpoints: DeviceProcessEvents with FileName=python.exe and ProcessCommandLine containing 'theHarvester' and '-b google'.
Test 2CrossLinked LinkedIn Employee Name to Email Permutation
Expected signal: Sysmon Event ID 1: process create for python3 with CommandLine containing 'CrossLinked' or 'crosslinked' and '-f' and '{first}.{last}'. Sysmon Event ID 3: outbound DNS and TCP connections to linkedin.com and www.linkedin.com on port 443. Sysmon Event ID 11: file creation at /tmp/crosslinked_names.txt. DeviceProcessEvents (MDE): ProcessCommandLine containing 'crosslinked' or '{first}.{last}'.
Test 3Corporate Team Page Automated Scraping Simulation
Expected signal: Sysmon Event ID 3 (Network Connect): repeated outbound connections to httpbin.org:443. Process creation for curl. In a real environment targeting a corporate web property: WAF/proxy logs showing 30+ requests to /team, /about-us, /staff URLs from the same source IP within 60 seconds with User-Agent 'Python-urllib/3.9'. CommonSecurityLog entries with RequestURL matching directory patterns.
Test 4recon-ng LinkedIn Contacts Module Employee Enumeration
Expected signal: Sysmon Event ID 1: process create for recon-ng binary or python3 with recon-ng in command path. Sysmon Event ID 11: file creation in ~/.recon-ng/workspaces/employee_hunt/ including SQLite database data.db. Sysmon Event ID 3: outbound connections to linkedin.com, api.linkedin.com on port 443. DeviceProcessEvents: FileName containing 'recon-ng' or ProcessCommandLine containing 'recon-ng'.
Test 5Hunter.io API Employee Name and Email Harvesting
Expected signal: Sysmon Event ID 3: outbound DNS query for api.hunter.io and TCP connection to api.hunter.io:443. Process creation for curl or python3 with api.hunter.io in command line arguments. In proxy/web access logs: GET requests to api.hunter.io/v2/domain-search with domain parameter. If monitoring DNS (Sysmon Event ID 22): DNS query for api.hunter.io.

Last updated: 2026-04-13 Research depth: deep

References (10)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1589.003 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Employee Names in Google Chronicle

MITRE ATT&CK

YARA-L Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1589.003

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Reconnaissance

Popular Detections

MITRE ATT&CK

YARA-L Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1589.003

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Reconnaissance

Popular Detections

Get new detections in your inbox