SE-HELPDESK-RESETCredential Access

Helpdesk Social Engineering — MFA / Password Reset

Call helpdesk pretending to be the user, request password / MFA factor reset. Often paired with vishing scripts and partial PII.

§ Where this technique fits

SE-HELPDESK-RESET is catalogued under the Credential Access tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 4 on average.

§ Dossiers chaining this technique

Vishing → helpdesk MFA reset → account takeover
Pose as a panicked employee locked out before a meeting. Helpdesk resets MFA based on partial PII (employee ID + date of birth from LinkedIn). Attacker registers their own factor.
step 4 / 6

§ What commonly comes next

01
Account Manipulation
T1098 · Persistence
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

Vishing → helpdesk MFA reset → account takeover

§ What commonly comes next