Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-PretextingHelpdeskInfoGathering.
Unlock with Pro - from £29/user/moPhishing for Information — Pretexting and Phishing for Information via Helpdesk Social Engineering
Reconnaissance-stage social engineering in which attackers contact an organization's helpdesk or employees by phone (vishing) or email under a false pretext — posing as a new hire, executive, or IT staff member — to elicit organizational information: employee IDs, org charts, software/VPN inventory, internal extensions, and password/MFA reset procedures. This intelligence is then weaponized for initial access, most notably by Scattered Spider (UNC3944), which called helpdesks impersonating employees to talk agents into resetting passwords and MFA enrollment ahead of the 2023 MGM Resorts and Caesars Entertainment intrusions. CISA AA23-320A documents the pattern: pretext call/email gathers org info and builds rapport, followed by a credential or MFA reset request that helpdesk staff approve without adequate identity verification. Because the initial contact rarely trips EDR, detection relies on correlating inbound lure emails impersonating IT/helpdesk with anomalous downstream identity operations (mass or unverified resets) performed by helpdesk-privileged accounts.
What is THREAT-Recon-PretextingHelpdeskInfoGathering Pretexting and Phishing for Information via Helpdesk Social Engineering?
Pretexting and Phishing for Information via Helpdesk Social Engineering (THREAT-Recon-PretextingHelpdeskInfoGathering) is a sub-technique of Phishing for Information (T1598) in the MITRE ATT&CK framework. It maps to the Reconnaissance tactic — the adversary is trying to gather information they can use to plan future operations.
This page provides production-ready detection logic for Pretexting and Phishing for Information via Helpdesk Social Engineering, covering the data sources and telemetry it touches: Microsoft Defender for Office 365 (EmailEvents), Microsoft Entra ID Audit Logs (AuditLogs), Microsoft 365 Defender. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.
MITRE ATT&CK
- Tactic
- Reconnaissance
// THREAT: Pretexting / Phishing for Information targeting Helpdesk (T1598)
// Alert 1: Inbound email lures impersonating IT/helpdesk soliciting org info or credential/MFA reset
// Alert 2: Helpdesk-initiated password/MFA resets across many distinct accounts in a short window
// -- the observable follow-through of a successful vishing/pretext call
let PretextKeywords = dynamic([
"verify your identity", "confirm your employee id", "employee id number",
"organizational chart", "org chart", "password reset request",
"mfa reset", "multi-factor reset", "reset your authenticator",
"help desk verification", "service desk ticket", "temporary access code",
"confirm your extension", "new hire onboarding list", "list of employees",
"vpn configuration details", "software inventory", "confirm your manager"
]);
let HelpdeskLikeNames = dynamic([
"helpdesk", "help desk", "it support", "service desk", "it service desk",
"technical support"
]);
// Alert 1: External sender impersonating helpdesk/IT soliciting sensitive org info
EmailEvents
| where Timestamp > ago(24h)
| where DeliveryAction in ("Delivered", "Junked")
| where EmailDirection == "Inbound"
| where SenderDisplayName has_any (HelpdeskLikeNames)
| where Subject has_any (PretextKeywords)
| extend PretextMatch = "Helpdesk_Impersonation_InfoGathering"
| project Timestamp, NetworkMessageId, SenderFromAddress, SenderDisplayName, SenderIPv4,
RecipientEmailAddress, Subject, DeliveryAction, ThreatTypes, DetectionMethods, PretextMatch
| extend ThreatType = "Phishing_InfoGathering_Lure";
// Alert 2: Helpdesk-privileged account resetting password/MFA for many distinct users within an hour
AuditLogs
| where TimeGenerated > ago(24h)
| where OperationName in ("Reset user password", "Reset password (self-service or admin)", "Update user", "Disable Strong Authentication")
| extend InitiatedByUPN = tostring(InitiatedBy.user.userPrincipalName)
| where InitiatedByUPN has_any (HelpdeskLikeNames)
| extend TargetUser = tostring(TargetResources[0].userPrincipalName)
| summarize ResetCount = dcount(TargetUser), TargetUsers = make_set(TargetUser), Operations = make_set(OperationName)
by InitiatedByUPN, bin(TimeGenerated, 1h)
| where ResetCount >= 3
| extend ThreatType = "Helpdesk_MassReset_PretextFollowThrough"Two-vector detection for T1598 helpdesk pretexting: (1) inbound emails whose display name impersonates IT/helpdesk and whose subject line matches known info-gathering/reset-pretext lure language — the initial reconnaissance contact; (2) Azure AD AuditLogs showing a helpdesk-privileged account resetting passwords or disabling/updating MFA for three or more distinct users within a single hour — the observable outcome of a vishing pretext succeeding at scale, matching the Scattered Spider MGM/Caesars MO documented in CISA AA23-320A.
Data Sources
Required Tables
False Positives
- Legitimate internal IT/helpdesk newsletters or automated password-expiration reminder emails that reuse similar phrasing ("password reset", "verify your identity") — tune by allow-listing your organization's actual helpdesk sending domain and DKIM/SPF-authenticated addresses
- A genuine helpdesk operator performing bulk password resets during an approved mass-reset event (e.g., post-breach precautionary rotation or new-hire cohort onboarding) — correlate with a change ticket or maintenance window before alerting
- Security awareness training platforms (KnowBe4, Proofpoint) sending simulated helpdesk-pretext phishing tests to measure employee susceptibility — exclude by known training platform sending infrastructure
- IT service management tools (ServiceNow, Freshservice) that auto-generate email notifications referencing employee IDs or ticket numbers as part of normal ticket workflows
Sigma rule & cross-platform mapping
The detection logic for Pretexting and Phishing for Information via Helpdesk Social Engineering (THREAT-Recon-PretextingHelpdeskInfoGathering) above is provided in a vendor-neutral
form so you can deploy it on any SIEM. The same logic is shipped here as native
KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the
following logsource:
logsource:
product: azureBrowse the community-maintained Sigma rules for this technique:
Platform-specific guides for THREAT-Recon-PretextingHelpdeskInfoGathering
References (5)
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated Helpdesk-Impersonation Phishing Lure Delivery
Expected signal: EmailEvents record with SenderDisplayName containing 'Help Desk', inbound direction, Subject matching pretext keyword list.
- Test 2Simulated Mass Helpdesk Password Reset (Graph PowerShell)
Expected signal: AuditLogs entries for 'Reset user password' with InitiatedBy matching the test helpdesk operator account, TargetResources listing three distinct users within the same hour.
- Test 3Simulated Post-Reset New-Device MFA Registration
Expected signal: Entra ID authentication methods audit trail showing a new phone method registered for atomic-test-user1 within minutes of the Alert 2 reset event.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-PretextingHelpdeskInfoGathering — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month