Friend/Follow/Connect to targets of interest

Once a persona has been developed an adversary will use it to create connections to targets of interest. These connections may be direct or may include trying to connect through others. [1] [2]

ID: T1344
Sub-techniques:  No sub-techniques
Tactic: Persona Development
Version: 1.0
Created: 14 December 2017
Last Modified: 17 October 2018

Similar Techniques by Tactic

Tactic Technique
Stage Capabilities Friend/Follow/Connect to targets of interest


Detectable by Common Defenses (Yes/No/Partial): No

Explanation: Unless there is some threat intelligence reporting, these users are hard to differentiate.

Difficulty for the Adversary

Easy for the Adversary (Yes/No): Yes

Explanation: The nature of social media is such that the adversary naturally connects to a target of interest without suspicion, given the purpose of the platform is to promote connections between individuals. Performing activities like typical users, but with specific intent in mind.


  1. Mike Lennon. (2014, May 29). Iranian Hackers Targeted US Officials in Elaborate Social Media Attack Operation. Retrieved March 1, 2017.
  1. Thomas Ryan. (2010). “Getting In Bed with Robin Sage.”. Retrieved March 6, 2017.