Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-PretextingHelpdeskInfoGathering.
Unlock with Pro - from £29/user/moDetect Pretexting and Phishing for Information via Helpdesk Social Engineering in Google Chronicle
Reconnaissance-stage social engineering in which attackers contact an organization's helpdesk or employees by phone (vishing) or email under a false pretext — posing as a new hire, executive, or IT staff member — to elicit organizational information: employee IDs, org charts, software/VPN inventory, internal extensions, and password/MFA reset procedures. This intelligence is then weaponized for initial access, most notably by Scattered Spider (UNC3944), which called helpdesks impersonating employees to talk agents into resetting passwords and MFA enrollment ahead of the 2023 MGM Resorts and Caesars Entertainment intrusions. CISA AA23-320A documents the pattern: pretext call/email gathers org info and builds rapport, followed by a credential or MFA reset request that helpdesk staff approve without adequate identity verification. Because the initial contact rarely trips EDR, detection relies on correlating inbound lure emails impersonating IT/helpdesk with anomalous downstream identity operations (mass or unverified resets) performed by helpdesk-privileged accounts.
MITRE ATT&CK
- Tactic
- Reconnaissance
YARA-L Detection Query
rule helpdesk_pretext_phishing_lure {
meta:
author = "df00tech Detection Engineering"
description = "Detects inbound email impersonating IT/helpdesk with reset or org-info-gathering pretext language, the initial contact stage of T1598 helpdesk pretexting."
severity = "HIGH"
priority = "MEDIUM"
mitre_attack_tactic = "Reconnaissance"
mitre_attack_technique = "T1598"
reference = "https://attack.mitre.org/techniques/T1598/"
created = "2026-05-12"
version = "1.0"
events:
$email.metadata.event_type = "EMAIL_TRANSACTION"
$email.network.email.from = /(?i)(helpdesk|help.desk|itsupport|servicedesk)/
$email.network.email.subject = /(?i)(verify your identity|password reset|mfa reset|org chart|employee id|service desk ticket)/
condition:
$email
}
rule helpdesk_mass_reset_pretext_followthrough {
meta:
author = "df00tech Detection Engineering"
description = "Detects a helpdesk-identified actor resetting password or MFA state for three or more distinct users within one hour, the observable outcome of a successful pretext call."
severity = "HIGH"
priority = "HIGH"
mitre_attack_tactic = "Reconnaissance"
mitre_attack_technique = "T1598"
created = "2026-05-12"
version = "1.0"
events:
$reset.metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
$reset.target.user.userid = $targetuser
$reset.principal.user.userid = $actor
$actor = /(?i)(helpdesk|support|servicedesk)/
match:
$actor over 1h
condition:
#targetuser >= 3
}Two Chronicle YARA-L 2.0 rules. The first flags inbound EMAIL_TRANSACTION events whose sender name impersonates helpdesk/IT with reset or info-gathering pretext subject language. The second uses a match-over-time aggregation to flag a single helpdesk-identified principal performing password/permission-reset actions against three or more distinct target users within a one-hour window, capturing the mass-reset follow-through of a successful pretext campaign.
Data Sources
Required Tables
False Positives & Tuning
- Verified internal helpdesk distribution addresses sending legitimate reset reminders — add an exception reference list of authenticated helpdesk sending domains
- A ticketed, approved bulk password rotation performed by the real helpdesk team
- Security awareness platforms sending simulated pretext-phishing test emails
Other platforms for THREAT-Recon-PretextingHelpdeskInfoGathering
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated Helpdesk-Impersonation Phishing Lure Delivery
Expected signal: EmailEvents record with SenderDisplayName containing 'Help Desk', inbound direction, Subject matching pretext keyword list.
- Test 2Simulated Mass Helpdesk Password Reset (Graph PowerShell)
Expected signal: AuditLogs entries for 'Reset user password' with InitiatedBy matching the test helpdesk operator account, TargetResources listing three distinct users within the same hour.
- Test 3Simulated Post-Reset New-Device MFA Registration
Expected signal: Entra ID authentication methods audit trail showing a new phone method registered for atomic-test-user1 within minutes of the Alert 2 reset event.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-PretextingHelpdeskInfoGathering — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month