AN2008: Analytic 2008
Consider monitoring social media activity related to your organization. Suspicious activity may include personas claiming to work for your organization or recently modified accounts making numerous connection requests to accounts affiliated with your organization. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: Phishing). Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).
Analyst context for executives and security teams
This analytic is about recognizing suspicious pre-compromise activity that may occur before an attacker reaches owned systems, especially social-media behavior such as fake personas claiming affiliation with the organization or recently changed accounts sending many connection requests to employees. Its practical value is that it highlights an exposure area many organizations do not monitor well: activity outside the corporate network that can still shape phishing, impersonation, and initial access risk.
Executive priority
Treat this as a readiness and governance question rather than a guaranteed alert source. Leaders should ask who owns monitoring for organization-related impersonation and employee-targeting activity, how findings are escalated to security and communications teams, and whether the SOC can connect external warning signs to later Initial Access investigations such as phishing. Because ATT&CK notes that much of this activity occurs outside target visibility, expectations should focus on defensible process, evidence collection, and response playbooks rather than complete coverage.
Technical view
The supplied ATT&CK object is a detection analytic for the PRE platform with no specified tactic and no relationship context. SOC and detection teams should validate whether they have procedures or feeds for monitoring social media activity involving the organization, including suspected employee impersonation and unusual connection-request patterns aimed at affiliated accounts. The description also mentions monitoring anomalous protocol traffic patterns and correlating packet inspection with process and command-line telemetry; teams should treat that portion as a separate validation area for network and endpoint correlation, especially where later-stage activity may follow external targeting.
Likely telemetry
- Social media or brand-impersonation monitoring results related to the organization
- Reports of personas claiming employment or affiliation with the organization
- Evidence of recently modified accounts making numerous connection requests to organization-affiliated accounts
- Phishing reports and Initial Access investigation records that may correlate with external targeting
- Network traffic metadata or packet inspection showing anomalous protocol flows where available
Detection direction
- Do not assume full visibility: ATT&CK explicitly notes much of the relevant activity may occur outside the target organization’s view.
- Define escalation criteria for suspected impersonation, suspicious connection campaigns, and organization-themed social media activity.
- Correlate external observations with phishing reports or other Initial Access investigation data when available.
- For the network-behavior portion of the description, validate that protocol anomalies can be tied to process and command-line context to reduce weak standalone network alerts.
- Account for false positives such as legitimate recruiting, marketing, employee networking, renamed personal accounts, or benign protocol irregularities.
Mitigation priorities
- Establish ownership for monitoring organization-related social media impersonation and employee-targeting reports.
- Create a cross-functional response path involving security operations, incident response, identity/access teams, and communications or legal functions as appropriate.
- Train employees to report suspicious connection requests, impersonation, and phishing attempts through approved channels.
- Preserve evidence from external reports so it can support later incident response or compliance/audit questions.
- Where network anomaly monitoring is in scope, prioritize correlation between packet/protocol telemetry and endpoint process or command-line evidence before operationalizing alerts.
Analyst notes and limits
This object is an ATT&CK detection analytic, not a technique. The official description combines external social media monitoring guidance with network protocol anomaly monitoring and endpoint correlation guidance. With no relationships supplied, the safest interpretation is to use it as validation guidance for monitoring and correlation rather than as a complete detection rule.
Official detection content is not provided, tactics are not specified, platforms are limited to PRE, and no relationships were supplied. Local tooling, legal/privacy constraints, social media visibility, network telemetry, and endpoint logging determine whether this analytic can be implemented effectively.
Analytic 2008
Consider monitoring social media activity related to your organization. Suspicious activity may include personas claiming to work for your organization or recently modified accounts making numerous connection requests to accounts affiliated with your organization. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: Phishing). Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | a68bac7bc3f1… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN2008Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.