conducting-social-engineering-pretext-call

name	conducting-social-engineering-pretext-call
description	Plan and execute authorized vishing (voice phishing) pretext calls to assess employee susceptibility to social engineering and evaluate security awareness controls.
domain	cybersecurity
subdomain	red-teaming
tags	["social-engineering","vishing","pretext-call","security-awareness","red-team","phishing","human-risk"]
version	1.0
author	mahipal
license	Apache-2.0
atlas_techniques	["AML.T0088","AML.T0052"]
nist_ai_rmf	["GOVERN-6.2","MAP-5.2"]
d3fend_techniques	["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"]
nist_csf	["ID.RA-01","GV.OV-02","DE.AE-07"]
mitre_attack	["T1598.004","T1566.004","T1589","T1591","T1598"]
source	https://github.com/mukul975/Anthropic-Cybersecurity-Skills
source_commit	04450304b12645cb2b974ab96d28c0664758a88d

Conducting Social Engineering Pretext Call

Overview

A pretext call (vishing) is a social engineering technique where an attacker impersonates a trusted authority figure over the phone to manipulate targets into divulging sensitive information, performing actions, or granting access. In red team engagements, pretext calls test the human element of security controls, measuring employee adherence to verification procedures and security awareness training effectiveness. MITRE ATT&CK maps this to T1566.004 (Phishing for Information: Voice) and T1598 (Phishing for Information).

When to Use

• When conducting security assessments that involve conducting social engineering pretext call
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Written authorization specifying social engineering scope and boundaries
• List of approved target employees (usually provided by client)
• OSINT research on targets and organization
• Spoofed caller ID capability (authorized for testing)
• Call recording equipment (with legal consent as required)
• Pretext scenarios approved by client

MITRE ATT&CK Mapping

Technique ID	Name	Tactic
T1566.004	Phishing: Voice	Initial Access
T1598	Phishing for Information	Reconnaissance
T1598.003	Phishing for Information: Spearphishing Voice	Reconnaissance
T1589	Gather Victim Identity Information	Reconnaissance
T1591	Gather Victim Org Information	Reconnaissance

Phase 1: OSINT and Target Research

# LinkedIn employee enumeration
theHarvester -d targetcorp.com -b linkedin -l 200

# Company org chart and employee roles
# Review LinkedIn, corporate website "About Us" / "Team" pages

# Technology stack identification
# Check job postings for technology references (VPN vendor, email, helpdesk tool)

# Phone system identification
# Call main line, note IVR options, department names, extension patterns