AMITT/counters/C00039.md
2021-02-19 08:00:20 +00:00

1.2 KiB

Standard reporting for false profiles

  • Type: Counter TTP

  • Name: Standard reporting for false profiles

  • Id: C00039

  • Summary: Deplatform. Reporting fake profiles is the only solution (identity issues). Only resolution

  • Playbooks: Playbook 1: Create a standard reporting format and method for social platforms for reporting false accounts. Playbook 2:

  • Is the account compromised?
  • Is it known to be associated with threat actors
  • common/random name
  • Names violate terms of service
  • Dormant account
  • Change of country IP
  • Social network growth patterns (number of friends etc)
  • Evidence of linguistic artifacts (multiple fingerprints, terms/idiosyncrasies )
  • Community vs. narrative vs. individuals Playbook 3: Report suspected bots.
  • Report ToS violations
  • Metatechnique: removal

  • Resources needed: nan

  • Belongs to tactic stage: TA03

Counters these Tactics
Counters these Techniques
C00039 Create fake Social Media Profiles / Pages / Groups
Seen in incidents

DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW