Rows marked inferred are OSINT-extracted enrichment for actors without a MITRE Group ID — treat as analyst assessment, not authoritative ATT&CK attribution.
| Technique | Name | Tactic | Observed use |
|---|---|---|---|
| T1005 ↗inferred | Data from Local System | Collection | steals voter records, PII and media assets for hack-and-leak (FBI/CISA) |
| T1125 ↗inferred | Video Capture | Collection | hacked and streamed compromised IP cameras against Israeli audiences (AA24-290A) |
| T1656 ↗inferred | Impersonation | Defense Evasion | impersonated the Proud Boys to send voter-intimidation emails (DOJ) |
| T1491.002 ↗inferred | Defacement: External Defacement | Impact | defaces compromised sites for psychological effect (FBI) |
| T1190 ↗inferred | Exploit Public-Facing Application | Initial Access | compromises vulnerable web/CMS infrastructure (FBI/CISA AA24-290A) |
| T1585.002 ↗inferred | Establish Accounts: Email Accounts | Resource Development | runs mass email intimidation campaigns (DOJ 2020 election-interference) |
| T1585.001 ↗inferred | Establish Accounts: Social Media Accounts | Resource Development | operates fabricated hacktivist personas to amplify operations (DOJ/FBI) |
Regional co-occurrence is association, not prediction. These techniques appeared alongside Emennet Pasargad's activity across the tracked MENA roster — a TIE-style association computed on our corpus (not CTID's model), not a prediction of the next move. Ranked by support-adjusted lift (over-representation among actors like this one vs. the roster base rate, damped when few actors back it), so neither a merely-common technique nor a tiny-sample coincidence floats to the top. A hunting lead only; never recorded as observed. ICS techniques are excluded.
Which Microsoft 365 controls protect, detect, or respond to this actor's techniques — from the CTID Mappings Explorer (technique-level). Strength: significant / partial / minimal.
Defensive techniques that counter Emennet Pasargad's TTPs, from MITRE D3FEND. The ATT&CK↔D3FEND link is mitigation-mediated — treat these as candidate countermeasures, not prescriptions.