T1585
Establish Accounts
Out of scope
This technique happens before any contact with a monitored environment, so no range can observe it. It is indexed here for reference and will not receive a write-up. Why Resource Development is out of scope
Telemetry needed
The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.
- Network flow records (Zeek conn, NetFlow, firewall flow) (the log as a whole)
- Non-telemetry sources (internet scans, malware repositories, domain registration, persona) (the log as a whole)