T1684
Social Engineering
Linux · macOS · Office Suite · SaaS · Windowsnothing on this site yetT1684 on attack.mitre.org
Adversaries may use social engineering techniques to influence users to take actions that result in unauthorized access, approval of changes, disclosure of sensitive information, or execution of adversary-supplied instructions (i.e., introduction of malicious payloads or software), while minimizing technical indicators.
how MITRE says to see it
Detect Social Engineering
- Detects users executing commands copied from chats, tickets, or emails, including curl|bash patterns, shell script launches from temp directories, credential changes, or SSH key additions shortly after communication events.
- Detects user execution of newly received content or instructions shortly after external communication, including script launches, Office child process spawning, browser-to-script execution chains, or credential prompts followed by new logon sessions.
- Detects consent grants, password resets, role changes, external sharing, or token creation shortly after user interaction with messages, invites, or help desk workflows. Emphasis is placed on unusual requester relationships, new device context, or off-hours approvals.
- Detects suspicious inbound communications or collaboration requests followed by rapid sensitive user actions such as file sharing changes, macro enablement, OAuth consent, credential submission, or financial workflow approvals that deviate from historical relationships or normal approval patterns.
what reduces it
- M1017 User Training. Reduces success of phishing/vishing/impersonation and modern “human interface” lures.
- M1047 Audit. Enables correlation of email/identity/SaaS/endpoint activity that appears legitimate.
- M1036 Account Use Policies. Adds verification for helpdesk resets, approvals, and app consents commonly targeted by impersonation.