## Social Media Intelligence (SOCMINT)

People are the weakest link. They overshare. SOCMINT exploits this to gather intelligence on targets (employees) or threats (hackers).

---

### Key Platforms
1.  **LinkedIn**: The #1 source for corporate recon.
    *   *Attacker View*: "I need to phish the SysAdmin. I'll search LinkedIn for `System Administrator` at `Target Company`. Oh, here is Bob. Bob lists `Cisco ASA` in his skills. Now I know they use Cisco firewalls."
2.  **Twitter / X**: Real-time news ticker.
    *   Security researchers post 0-days here first.
    *   Hacktivists announce DDoS attacks here.
    *   *Search*: `(from:user) until:2023-01-01` (Time travel).
3.  **Telegram**: The modern "Dark Web".
    *   Ransomware groups run public "News Channels" to name-and-shame victims.
    *   Cybercrime markets sell access and tools in group chats.

### Username Enumeration
We are creatures of habit. If my handle is `hacker_123` on Reddit, it is probably `hacker_123` on GitHub and Instagram.
*   **Concept**: Identity Resolution. Connecting a digital persona across different platforms to build a full profile.
*   **Tool**: **Sherlock** or **WhatsMyName**. These scripts query hundreds of websites: "Does `user/hacker_123` exist?"

### HUMINT (Human Intelligence)
In the digital world, this means interacting with people to get info.
*   **Scenario**: An analyst joins a discord server for a hacking tool and asks "Does this allow persistence?" to understand its capabilities.
*   **Risk**: **Extreme**. Interacting with threat actors can legally verify them, tip them off, or violate specific laws (like providing material support if you buy something).
*   **Policy**: Most SOCs have a strict "Passive Only" policy. You can watch, but you cannot talk.