T1684.001 — Impersonation

Tactic: Stealth · Platforms: Linux, macOS, Office Suite, SaaS, Windows

Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known…

Sub-technique of Social Engineering (T1684).

Sigma detection rules (5)

title: "T1684.001 Social Engineering: Impersonation"
id: e723b06d-6788-4cb4-aecd-cab491b4295e
description: 'Impersonation (a spoofed message purporting to be from a trusted person) is mail/message content and is not directly observable via Windows Sysmon/Security telemetry. As the closest defensible Windows-observable proxy, this rule flags an interactive or remote logon (4624, LogonType 3/10) for an account, intended to be paired with a per-account known-workstation/source-IP baseline -- the precursor pattern seen when an adversary uses a compromised account to send impersonation messages internally. This rule alone is low-confidence; real coverage needs mail-gateway/O365 message-trace sender-verification data. Tune using: KnownWorkstationBaseline, GeoLocationBaseline.'
references:
  - https://attack.mitre.org/techniques/T1684/001
author: Shahrukh Khan
date: 2026-02-26
license: MIT
tags:
  - attack.stealth
  - attack.t1684.001

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: '4624'
    LogonType:
      - 3
      - 10
  filter_system_account:
    TargetUserName|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - This is a low-confidence proxy since Windows telemetry cannot see message content or sender spoofing directly; a true positive requires correlating this logon against a per-account baseline of known workstations/source IPs, which this rule alone does not implement. Pair with mail-gateway/O365 message-trace sender-verification data for real coverage.

level: low

title: "T1684.001 Social Engineering: Impersonation"
id: 5e735454-53a7-439c-b01c-729baf703af0
description: 'T1684.001 Impersonation is a social-engineering technique where an adversary poses as a trusted person/organization in communications (email, messaging) to manipulate a victim -- the deception happens in message content and human judgment, not in an OS syscall, so it has no direct Linux auditd/syscall signature. The prior logic (SSH ProxyJump/ProxyCommand usage) was network pivoting/lateral-movement behavior with no connection to impersonation whatsoever. As the closest defensible Linux-observable proxy, this rule flags execution of mail-transfer/mail-client CLI tools with an explicit envelope-sender/From override -- the one host-level action a compromised Linux host (e.g. a hijacked mail relay or webshell) would take to relay spoofed-identity email as part of a BEC/impersonation campaign. This cannot detect the impersonation itself (message wording, spoofed display name in a client the recipient trusts, etc.) -- only that a sender identity was explicitly overridden by a mail-sending process on this host. Tune using: KnownRelayHosts.'
references:
  - https://attack.mitre.org/techniques/T1684/001
author: Shahrukh Khan
date: 2026-05-23
license: MIT
tags:
  - attack.stealth
  - attack.t1684.001

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_mail_sender_override:
    type: EXECVE
    a0|endswith:
      - '/sendmail'
      - '/exim'
      - '/exim4'
      - '/mail'
      - '/mutt'
      - '/msmtp'
    a1|contains:
      - '-f'
      - '-r'
      - '--from'

  condition: selection_mail_sender_override

falsepositives:
  - Legitimate automation (cron jobs, monitoring alerts, ticketing systems, mailing-list software) that explicitly sets an envelope-sender/From address for outbound notification email; tune KnownRelayHosts to the organization's approved mail-relay/application hosts.
  - This rule cannot confirm impersonation actually occurred (that requires evaluating message content/recipient trust) -- it only flags sender-identity override capability being invoked.

level: medium

title: "T1684.001 Social Engineering: Impersonation"
id: a390d308-888e-4704-84f9-fbd00ccbb24b
description: 'Detection Strategy for Impersonation. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TrustedMailClients.'
references:
  - https://attack.mitre.org/techniques/T1684/001
author: Shahrukh Khan
date: 2026-03-28
license: MIT
tags:
  - attack.stealth
  - attack.t1684.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|endswith: '/Mail.app/Contents/MacOS/Mail'
    Image|endswith:
      - '/installer'
      - '/Microsoft Word'
      - '/Microsoft Excel'

  condition: selection

falsepositives:
  - Users legitimately opening an expected Office document or signed installer attachment sent by a trusted internal sender.

level: medium

title: "T1684.001 Social Engineering: Impersonation"
id: fad6ab69-df1c-4ca2-bd6e-c9a4ea601986
description: 'Detection Strategy for Impersonation. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: DelegationBaseline.'
references:
  - https://attack.mitre.org/techniques/T1684/001
author: Shahrukh Khan
date: 2026-03-24
license: MIT
tags:
  - attack.stealth
  - attack.t1684.001

logsource:
  product: gcp
  service: workspaceaudit

detection:
  selection:
    protoPayload.methodName: 'google.admin.AdminService.createDelegatedAdmin'

  condition: selection

falsepositives:
  - IT administrators legitimately provisioning new delegated admin roles as part of approved staff onboarding.

level: high

title: "T1684.001 Social Engineering: Impersonation"
id: 3191d251-63bf-4666-9d86-07c012fe98eb
description: 'Detection Strategy for Impersonation. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: MacroExecutionThreshold.'
references:
  - https://attack.mitre.org/techniques/T1684/001
author: Shahrukh Khan
date: 2026-06-15
license: MIT
tags:
  - attack.stealth
  - attack.t1684.001

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation: 'MacroExecution'

  condition: selection

falsepositives:
  - Automated document processing pipelines that legitimately execute macros at high frequency across a large batch of files; distinguishing high-frequency automation from an attack chain requires a count threshold best expressed as a correlation rule.

level: medium

Related sub-techniques

• T1684.002 Email Spoofing

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1684.001 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan