title: Social Media (T1593.001)
id: df00tech-t1593-001
status: experimental
description: "Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search different social media sites depending on what information they seek to gather, and may passively harvest data from these sites as well as use gathered information to create fake profiles to elicit victims into revealing specific information. Groups such as Kimsuky have used Twitter to monitor potential victims and prepare targeted phishing emails, while Contagious Interview solicited victims through LinkedIn and Telegram, and EXOTIC LILY copied data from social media sites to impersonate targeted individuals."
references:
  - https://attack.mitre.org/techniques/T1593/001/
  - https://df00tech.com/detections/T1593.001
author: df00tech
date: 2026/03/13
tags:
  - attack.t1593.001
# NOTE: logsource is auto-derived and may need adjustment for your environment
logsource:
  category: process_creation
  product: windows
detection:
  # This detection logic could not be auto-translated; see the KQL/SPL query on df00tech.
  selection:
    EventID: '*'
  condition: selection
falsepositives:
  - Authorized red team or penetration testing exercises conducting social media OSINT against the organization using the same tools
  - "Threat intelligence analysts and security researchers running theHarvester, SpiderFoot, or recon-ng as part of their job duties"
  - "Marketing and HR teams using LinkedIn Recruiter, Sales Navigator, or social media management platforms (Hootsuite, Sprout Social) with desktop applications making bulk API calls"
  - Security awareness training simulations that enumerate exposed employee information to demonstrate organizational risk
  - "Legitimate business intelligence or CRM integrations (Salesforce LinkedIn Sales Navigator, HubSpot) with non-browser agents making frequent social media API requests"
level: medium