T1566 Phishing | DetectionCode

About this technique

Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.

Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., "thread hijacking").

Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).

Detection rules99

Rules on DetectionCode tagged with T1566 or one of its sub-techniques.

Sigma26

Rule	Level	Log source	Technique
HTML Help HH.EXE Suspicious Child Process	high	windows / process_creation	T1566 T1566.001
ISO File Created Within Temp Folders	high	windows / file_event	T1566.001
Office Macro File Creation From Suspicious Process	high	windows / file_event	T1566.001
Okta FastPass Phishing Detection	high	okta / NULL	T1566
Password Protected ZIP File Opened (Email Attachment)	high	windows / NULL	T1566.001
Phishing Pattern ISO in Archive	high	windows / process_creation	T1566
Potential Malicious Usage of CloudTrail System Manager	high	aws / NULL	T1566 T1566.002
Suspicious Double Extension File Execution	high	windows / process_creation	T1566.001
Suspicious Execution From Outlook Temporary Folder	high	windows / process_creation	T1566.001
Suspicious External WebDAV Execution	high	NULL / proxy	T1566
Suspicious File Created in Outlook Temporary Directory	high	windows / file_event	T1566.001
Suspicious HH.EXE Execution	high	windows / process_creation	T1566 T1566.001
Suspicious HWP Sub Processes	high	windows / process_creation	T1566.001
Suspicious Microsoft OneNote Child Process	high	windows / process_creation	T1566 T1566.001
Arbitrary Shell Command Execution Via Settingcontent-Ms	medium	windows / process_creation	T1566.001
Disk Image Mounting Via Hdiutil - MacOS	medium	macos / process_creation	T1566.001
ISO Image Mounted	medium	windows / NULL	T1566.001
ISO or Image Mount Indicator in Recent Files	medium	windows / file_event	T1566.001
Potential Initial Access via DLL Search Order Hijacking	medium	windows / file_event	T1566 T1566.001
Suspicious Email Delivered In Microsoft 365	medium	m365 / NULL	T1566.001 T1566.002
Suspicious Execution via macOS Script Editor	medium	macos / process_creation	T1566 T1566.002
Windows Registry Trust Record Modification	medium	windows / registry_event	T1566.001
Download From Suspicious TLD - Blacklist	low	NULL / proxy	T1566
Download From Suspicious TLD - Whitelist	low	NULL / proxy	T1566
Office Macro File Creation	low	windows / file_event	T1566.001
Office Macro File Download	low	windows / file_event	T1566.001

Splunk73

Rule	Type	Risk	Data source	Technique
Azure AD Device Code Authentication	TTP	NULL	Azure Active Directory	T1566.002
Detect DNS requests to Phishing Sites leveraging EvilGinx2	TTP	NULL		T1566.003
Detect Outlook exe writing a zip file	Anomaly	NULL	Sysmon EventID 1 AND Sysmon EventID 11	T1566.001
Email Attachments With Lots Of Spaces	Anomaly	NULL		T1566.001
Gdrive suspicious file sharing	Hunting	NULL		T1566
GSuite Email Suspicious Attachment	Anomaly	NULL	G Suite Gmail	T1566.001
Gsuite Email Suspicious Subject With Attachment	Anomaly	NULL	G Suite Gmail	T1566.001
Gsuite Email With Known Abuse Web Service Link	Anomaly	NULL	G Suite Gmail	T1566.001
Gsuite suspicious calendar invite	Hunting	NULL		T1566
Gsuite Suspicious Shared File Name	Anomaly	NULL	G Suite Drive	T1566.001
Linux Ghostscript Exploitation	TTP	NULL	Sysmon for Linux EventID 1	T1566
MSHTML Module Load in Office Product	TTP	NULL	Sysmon EventID 7	T1566.001
O365 Email Reported By Admin Found Malicious	TTP	NULL	Office 365 Universal Audit Log	T1566.001 T1566.002
O365 Email Reported By User Found Malicious	TTP	NULL	Office 365 Universal Audit Log	T1566.001 T1566.002
O365 Safe Links Detection	TTP	NULL	Office 365 Universal Audit Log	T1566.001
O365 Threat Intelligence Suspicious Email Delivered	Anomaly	NULL	Office 365 Universal Audit Log	T1566.001 T1566.002
O365 ZAP Activity Detection	Anomaly	NULL	Office 365 Universal Audit Log	T1566.001 T1566.002
Office Application Drop Executable	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 11	T1566.001
Office Application Spawn Regsvr32 process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1566.001
Office Application Spawn rundll32 process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1566.001
Office Document Creating Schedule Task	TTP	NULL	Sysmon EventID 7	T1566.001
Office Document Executing Macro Code	TTP	NULL	Sysmon EventID 7	T1566.001
Office Document Spawned Child Process To Download	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1566.001
Office Product Spawn CMD Process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1566.001
Office Product Spawning BITSAdmin	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1566.001
Office Product Spawning CertUtil	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1566.001
Office Product Spawning MSHTA	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1566.001
Office Product Spawning Rundll32 with no DLL	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1566.001
Office Product Spawning Windows Script Host	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1566.001
Office Product Spawning Wmic	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1566.001
Office Product Writing cab or inf	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 11	T1566.001
Office Spawning Control	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1566.001
Process Creating LNK file in Suspicious Location	Anomaly	NULL	Sysmon EventID 11	T1566.002
Suspicious Email - UBA Anomaly	Anomaly	NULL		T1566
Suspicious Email Attachment Extensions	Anomaly	NULL		T1566.001
Windows CAB File on Disk	Anomaly	NULL	Sysmon EventID 11	T1566.001
Windows Defender ASR Audit Events	Anomaly	NULL	Windows Event Log Defender 1122, Windows Event Log Defender 1125, Windows Event Log Defender 1126, Windows Event Log Defender 1132, Windows Event Log Defender 1134	T1566.001 T1566.002
Windows Defender ASR Block Events	Anomaly	NULL	Windows Event Log Defender 1121, Windows Event Log Defender 1126, Windows Event Log Defender 1129, Windows Event Log Defender 1131, Windows Event Log Defender 1133	T1566.001 T1566.002
Windows Defender ASR Rules Stacking	Hunting	NULL	Windows Event Log Defender 1121, Windows Event Log Defender 1122, Windows Event Log Defender 1125, Windows Event Log Defender 1126, Windows Event Log Defender 1129, Windows Event Log Defender 1131, Windows Event Log Defender 1133, Windows Event Log Defender 1134, Windows Event Log Defender 5007	T1566.001 T1566.002
Windows InProcServer32 New Outlook Form	Anomaly	NULL	Sysmon EventID 13	T1566
Windows ISO LNK File Creation	Hunting	NULL	Sysmon EventID 11	T1566.001
Windows Office Product Dropped Cab or Inf File	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 11, Windows Event Log Security 4688 AND Sysmon EventID 11	T1566.001
Windows Office Product Dropped Uncommon File	Anomaly	NULL	Sysmon EventID 1 AND Sysmon EventID 11	T1566.001
Windows Office Product Loaded MSHTML Module	Anomaly	NULL	Sysmon EventID 7	T1566.001
Windows Office Product Loading Taskschd DLL	Anomaly	NULL	Sysmon EventID 7	T1566.001
Windows Office Product Loading VBE7 DLL	Anomaly	NULL	Sysmon EventID 7	T1566.001
Windows Office Product Spawned Child Process For Download	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1566.001
Windows Office Product Spawned Control	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1566.001
Windows Office Product Spawned MSDT	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1566.001
Windows Office Product Spawned Rundll32 With No DLL	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1566.001
Windows Office Product Spawned Uncommon Process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1566.001
Windows Office Product Spawning MSDT	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1566.001
Windows Phishing Outlook Drop Dll In FORM Dir	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 11	T1566
Windows Phishing PDF File Executes URL Link	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1566.001
Windows Phishing Recent ISO Exec Registry	Hunting	NULL	Sysmon EventID 13	T1566.001
Windows Spearphishing Attachment Connect To None MS Office Domain	Hunting	NULL	Sysmon EventID 22	T1566.001
Windows Spearphishing Attachment Onenote Spawn Mshta	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1566.001
Windows Universal Data Link File Creation	Anomaly	NULL	Sysmon EventID 11	T1566.001
Winword Spawning Cmd	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1566.001
Winword Spawning PowerShell	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1566.001
Winword Spawning Windows Script Host	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1566.001
Zscaler Adware Activities Threat Blocked	Anomaly	NULL		T1566
Zscaler Behavior Analysis Threat Blocked	Anomaly	NULL		T1566
Zscaler CryptoMiner Downloaded Threat Blocked	Anomaly	NULL		T1566
Zscaler Employment Search Web Activity	Anomaly	NULL		T1566
Zscaler Exploit Threat Blocked	TTP	NULL		T1566
Zscaler Legal Liability Threat Blocked	Anomaly	NULL		T1566
Zscaler Malware Activity Threat Blocked	Anomaly	NULL		T1566
Zscaler Phishing Activity Threat Blocked	Anomaly	NULL		T1566
Zscaler Potentially Abused File Download	Anomaly	NULL		T1566
Zscaler Privacy Risk Destinations Threat Blocked	Anomaly	NULL		T1566
Zscaler Scam Destinations Threat Blocked	Anomaly	NULL		T1566
Zscaler Virus Download threat blocked	Anomaly	NULL		T1566

Sub-techniques4

ID	Name	Examples
T1566.001	Spearphishing Attachment	149
T1566.002	Spearphishing Link	86
T1566.003	Spearphishing via Service	16
T1566.004	Spearphishing Voice	2

Groups8

Software3

Hikit INC Ransomware Royal

Campaigns0

None recorded.

Procedure examples11

Groups8

Used by	Procedure example
GroupAppleJeus	AppleJeus has used spearphishing emails to distribute malicious payloads. dtex DPRK 2025 structure ITworkers
GroupAxiom	Axiom has used spear phishing to initially compromise victims. Cisco Group 72 Novetta-Axiom
GroupGOLD SOUTHFIELD	GOLD SOUTHFIELD has conducted malicious spam (malspam) campaigns to gain access to victim's machines. Secureworks REvil September 2019
GroupINC Ransom	INC Ransom has used phishing to gain initial access. SOCRadar INC Ransom January 2024 SentinelOne INC Ransomware
GroupKimsuky	Kimsuky has used spearphishing to gain initial access and intelligence. MSFT-AI Mandiant APT43 March 2024
GroupMuddyWater	MuddyWater has sent phishing emails to targets from the email address support@microsoftonlines[.]com. NaumaanProofpoint_GlobalClickFix_April2025
GroupSea Turtle	Sea Turtle used spear phishing to gain initial access to victims. Talos Sea Turtle 2019
GroupVOID MANTICORE	VOID MANTICORE has emailed victims threatening messages. VOID MANTICORE has used phishing as an initial access vector. DOJ FBI Handala Hack March 2026 Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026

Software3

Used by	Procedure example
MalwareHikit	Hikit has been spread through spear phishing. Novetta-Axiom
MalwareINC Ransomware	INC Ransomware campaigns have used spearphishing emails for initial access. SentinelOne INC Ransomware
MalwareRoyal	Royal has been spread through the use of phishing campaigns including "call back phishing" where victims are lured into calling a number provided through email. CISA Royal AA23-061A March 2023 Cybereason Royal December 2022 Kroll Royal Deep Dive February 2023

References8

CISA Remote Monitoring and Management Software Open source
CISA. (n.d.). Protecting Against Malicious Use of Remote Monitoring and Management Software. Retrieved February 2, 2023.
Microsoft OAuth Spam 2022 Open source
Microsoft. (2023, September 22). Malicious OAuth applications abuse cloud email services to spread spam. Retrieved March 13, 2023.
Palo Alto Unit 42 VBA Infostealer 2014 Open source
Vicky Ray and Rob Downs. (2014, October 29). Examining a VBA-Initiated Infostealer Campaign. Retrieved March 13, 2023.
Proofpoint-spoof Open source
Proofpoint. (n.d.). What Is Email Spoofing?. Retrieved February 24, 2023.
Unit42 Luna Moth Open source
Kristopher Russo. (n.d.). Luna Moth Callback Phishing Campaign. Retrieved February 2, 2023.
cyberproof-double-bounce Open source
Itkin, Liora. (2022, September 1). Double-bounced attacks with email spoofing . Retrieved February 24, 2023.
phishing-krebs Open source
Brian Krebs. (2024, March 28). Thread Hijacking: Phishes That Prey on Your Curiosity. Retrieved September 27, 2024.
sygnia Luna Month Open source
Oren Biderman, Tomer Lahiyani, Noam Lifshitz, Ori Porag. (n.d.). LUNA MOTH: THE THREAT ACTORS BEHIND RECENT FALSE SUBSCRIPTION SCAMS. Retrieved February 2, 2023.