Adversaries may use a spearphishing attachment, a variant of spearphishing, as a form of a social engineering attack against specific targets. Spearphishing attachments are different from other forms of spearphishing in that they employ malware attached to an email. All forms of spearphishing are electronically delivered and target a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution and access.  A Chinese spearphishing campaign running from December 9, 2011 through February 29, 2012, targeted ONG organizations and their employees. The emails were constructed with a high level of sophistication to convince employees to open the malicious file attachments. 
APT33 sent spear phishing emails containing links to HTML application files, which were embedded with malicious code.  APT33 has conducted targeted spear phishing campaigns against U.S. government agencies and private sector companies. 
Lazarus Group has been observed targeting organizations using spearphishing documents with embedded malicious payloads.  Highly targeted spear phishing campaigns have been conducted against a U.S. electric grid company. 
Deploy anti-virus on all systems that support external email.
|M0931||Network Intrusion Prevention||
Network intrusion prevention systems and systems designed to scan and remove malicious email attachments can be used to block activity.
|M0921||Restrict Web-Based Content||
Consider restricting access to email within critical process environments. Additionally, downloads and attachments may be disabled if email is still necessary.
Users can be trained to identify social engineering techniques and spearphishing emails.
|ID||Data Source||Data Component|
|DS0015||Application Log||Application Log Content|
|DS0029||Network Traffic||Network Traffic Content|