T1566.001 Spearphishing Attachment

About this technique

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.

There are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. Upon opening the attachment (and potentially clicking past protections), the adversary's payload exploits a vulnerability or directly executes on the user's system. The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so. The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one.

Detection rules71

Rules on DetectionCode tagged with T1566.001.

Sigma19

Rule	Level	Log source
HTML Help HH.EXE Suspicious Child Process	high	windows / process_creation
ISO File Created Within Temp Folders	high	windows / file_event
Office Macro File Creation From Suspicious Process	high	windows / file_event
Password Protected ZIP File Opened (Email Attachment)	high	windows / NULL
Suspicious Double Extension File Execution	high	windows / process_creation
Suspicious Execution From Outlook Temporary Folder	high	windows / process_creation
Suspicious File Created in Outlook Temporary Directory	high	windows / file_event
Suspicious HH.EXE Execution	high	windows / process_creation
Suspicious HWP Sub Processes	high	windows / process_creation
Suspicious Microsoft OneNote Child Process	high	windows / process_creation
Arbitrary Shell Command Execution Via Settingcontent-Ms	medium	windows / process_creation
Disk Image Mounting Via Hdiutil - MacOS	medium	macos / process_creation
ISO Image Mounted	medium	windows / NULL
ISO or Image Mount Indicator in Recent Files	medium	windows / file_event
Potential Initial Access via DLL Search Order Hijacking	medium	windows / file_event
Suspicious Email Delivered In Microsoft 365	medium	m365 / NULL
Windows Registry Trust Record Modification	medium	windows / registry_event
Office Macro File Creation	low	windows / file_event
Office Macro File Download	low	windows / file_event

Splunk52

Rule	Type	Risk	Data source
Detect Outlook exe writing a zip file	Anomaly	NULL	Sysmon EventID 1 AND Sysmon EventID 11
Email Attachments With Lots Of Spaces	Anomaly	NULL
GSuite Email Suspicious Attachment	Anomaly	NULL	G Suite Gmail
Gsuite Email Suspicious Subject With Attachment	Anomaly	NULL	G Suite Gmail
Gsuite Email With Known Abuse Web Service Link	Anomaly	NULL	G Suite Gmail
Gsuite Suspicious Shared File Name	Anomaly	NULL	G Suite Drive
MSHTML Module Load in Office Product	TTP	NULL	Sysmon EventID 7
O365 Email Reported By Admin Found Malicious	TTP	NULL	Office 365 Universal Audit Log
O365 Email Reported By User Found Malicious	TTP	NULL	Office 365 Universal Audit Log
O365 Safe Links Detection	TTP	NULL	Office 365 Universal Audit Log
O365 Threat Intelligence Suspicious Email Delivered	Anomaly	NULL	Office 365 Universal Audit Log
O365 ZAP Activity Detection	Anomaly	NULL	Office 365 Universal Audit Log
Office Application Drop Executable	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 11
Office Application Spawn Regsvr32 process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Office Application Spawn rundll32 process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Office Document Creating Schedule Task	TTP	NULL	Sysmon EventID 7
Office Document Executing Macro Code	TTP	NULL	Sysmon EventID 7
Office Document Spawned Child Process To Download	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Office Product Spawn CMD Process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Office Product Spawning BITSAdmin	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Office Product Spawning CertUtil	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Office Product Spawning MSHTA	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Office Product Spawning Rundll32 with no DLL	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Office Product Spawning Windows Script Host	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Office Product Spawning Wmic	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Office Product Writing cab or inf	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 11
Office Spawning Control	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Suspicious Email Attachment Extensions	Anomaly	NULL
Windows CAB File on Disk	Anomaly	NULL	Sysmon EventID 11
Windows Defender ASR Audit Events	Anomaly	NULL	Windows Event Log Defender 1122, Windows Event Log Defender 1125, Windows Event Log Defender 1126, Windows Event Log Defender 1132, Windows Event Log Defender 1134
Windows Defender ASR Block Events	Anomaly	NULL	Windows Event Log Defender 1121, Windows Event Log Defender 1126, Windows Event Log Defender 1129, Windows Event Log Defender 1131, Windows Event Log Defender 1133
Windows Defender ASR Rules Stacking	Hunting	NULL	Windows Event Log Defender 1121, Windows Event Log Defender 1122, Windows Event Log Defender 1125, Windows Event Log Defender 1126, Windows Event Log Defender 1129, Windows Event Log Defender 1131, Windows Event Log Defender 1133, Windows Event Log Defender 1134, Windows Event Log Defender 5007
Windows ISO LNK File Creation	Hunting	NULL	Sysmon EventID 11
Windows Office Product Dropped Cab or Inf File	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 11, Windows Event Log Security 4688 AND Sysmon EventID 11
Windows Office Product Dropped Uncommon File	Anomaly	NULL	Sysmon EventID 1 AND Sysmon EventID 11
Windows Office Product Loaded MSHTML Module	Anomaly	NULL	Sysmon EventID 7
Windows Office Product Loading Taskschd DLL	Anomaly	NULL	Sysmon EventID 7
Windows Office Product Loading VBE7 DLL	Anomaly	NULL	Sysmon EventID 7
Windows Office Product Spawned Child Process For Download	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Office Product Spawned Control	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Office Product Spawned MSDT	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Office Product Spawned Rundll32 With No DLL	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Office Product Spawned Uncommon Process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Office Product Spawning MSDT	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Phishing PDF File Executes URL Link	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Phishing Recent ISO Exec Registry	Hunting	NULL	Sysmon EventID 13
Windows Spearphishing Attachment Connect To None MS Office Domain	Hunting	NULL	Sysmon EventID 22
Windows Spearphishing Attachment Onenote Spawn Mshta	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Universal Data Link File Creation	Anomaly	NULL	Sysmon EventID 11
Winword Spawning Cmd	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Winword Spawning PowerShell	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Winword Spawning Windows Script Host	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2

Groups78

Show 54 more

Software61

Agent Tesla AppleSeed Astaroth AsyncRAT BADFLICK Bandook Bisonal BLINDINGCAN Bumblebee Chaes Clambling DanBot DarkGate DarkTortilla DarkWatchman Emotet EnvyScout Flagpro Hancitor IcedID Javali JSS Loader Kali365 Kerrdown

Show 37 more

Campaigns10

2015 Ukraine Electric Power Attack C0011 C0015 Frankenstein Operation AkaiRyū Operation Dream Job Operation Dust Storm Operation Spalax RedDelta Modified PlugX Infection Chain Operations Water Curupira Pikabot Distribution

Procedure examples149

Groups78

Used by	Procedure example
Groupadmin@338	admin@338 has sent emails with malicious Microsoft Office documents attached. FireEye admin@338
GroupAjax Security Team	Ajax Security Team has used personalized spearphishing attachments. Check Point Rocket Kitten
GroupAndariel	Andariel has conducted spearphishing campaigns that included malicious Word or Excel attachments. AhnLab Andariel Subgroup of Lazarus June 2018 MalwareBytes Lazarus-Andariel Conceals Code April 2021
GroupAPT-C-36	APT-C-36 has used spearphishing emails with malicious .pdf and .docx files and password protected RAR attachments to avoid being detected by the email gateway. Kaspersky BlindEagle AUG 2024 QiAnXin APT-C-36 Feb2019 Recorded Future TAG-144 AUG 2025
GroupAPT1	APT1 has sent spearphishing emails containing malicious attachments. Mandiant APT1
GroupAPT12	APT12 has sent emails with malicious Microsoft Office documents and PDFs attached. Moran 2014 Trend Micro IXESHE 2012
GroupAPT19	APT19 sent spearphishing emails with malicious attachments in RTF and XLSM formats to deliver initial exploits. FireEye APT19
GroupAPT28	APT28 sent spearphishing emails containing malicious Microsoft Office and RAR attachments. Accenture SNAKEMACKEREL Nov 2018 Cato LAMEHUG JUL 2025 DOJ GRU Indictment Jul 2018 Palo Alto Sofacy 06-2018 Securelist Sofacy Feb 2018 Secureworks IRON TWILIGHT Active Measures March 2017 Sofacy DealersChoice TrendMicro Pawn Storm Dec 2020 Unit 42 Sofacy Feb 2018

View all 78 groups examples

Software61

Used by	Procedure example
MalwareAgent Tesla	The primary delivered mechanism for Agent Tesla is through email phishing messages. Bitdefender Agent Tesla April 2020
MalwareAppleSeed	AppleSeed has been distributed to victims through malicious e-mail attachments. Malwarebytes Kimsuky June 2021
MalwareAstaroth	Astaroth has been delivered via malicious e-mail attachments. Securelist Brazilian Banking Malware July 2020
ToolAsyncRAT	AsyncRAT has been delivered via malicious email attachments. Recorded Future TAG-144 AUG 2025
MalwareBADFLICK	BADFLICK has been distributed via spearphishing campaigns containing malicious Microsoft Word documents. Accenture MUDCARP March 2019
MalwareBandook	Bandook is delivered via a malicious Word document inside a zip file. CheckPoint Bandook Nov 2020
MalwareBisonal	Bisonal has been delivered as malicious email attachments. Talos Bisonal Mar 2020
MalwareBLINDINGCAN	BLINDINGCAN has been delivered by phishing emails containing malicious Microsoft Office documents. US-CERT BLINDINGCAN Aug 2020

View all 61 software examples

Campaigns10

Used by	Procedure example
Campaign2015 Ukraine Electric Power Attack	During the 2015 Ukraine Electric Power Attack, Sandworm Team obtained their initial foothold into many IT systems using Microsoft Office attachments delivered through phishing emails. Ukraine15 - EISAC - 201603
CampaignC0011	During C0011, Transparent Tribe sent malicious attachments via email to student targets in India. Cisco Talos Transparent Tribe Education Campaign July 2022
CampaignC0015	For C0015, security researchers assessed the threat actors likely used a phishing campaign to distribute a weaponized attachment to victims. DFIR Conti Bazar Nov 2021
CampaignFrankenstein	During Frankenstein, the threat actors likely used spearphishing emails to send malicious Microsoft Word documents. Talos Frankenstein June 2019
CampaignOperation AkaiRyū	During Operation AkaiRyū, MirrorFace distributed crafted spearphishing emails containing malicious attachments. ESET MirrorFace 2025 Trend Micro Earth Kasha Anel NOV 2024
CampaignOperation Dream Job	During Operation Dream Job, Lazarus Group sent emails with malicious attachments to gain unauthorized access to targets' computers. ClearSky Lazarus Aug 2020 McAfee Lazarus Jul 2020
CampaignOperation Dust Storm	During Operation Dust Storm, the threat actors sent spearphishing emails that contained a malicious Microsoft Word document. Cylance Dust Storm
CampaignOperation Spalax	During Operation Spalax, the threat actors sent phishing emails that included a PDF document that in some cases led to the download and execution of malware. ESET Operation Spalax Jan 2021

View all 10 campaigns examples

References1

Unit 42 DarkHydrus July 2018 Open source
Falcone, R., et al. (2018, July 27). New Threat Actor Group DarkHydrus Targets Middle East Government. Retrieved August 2, 2018.