Phishing

Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.

Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).[1][2] Another way to accomplish this is by forging or spoofing[3] the identity of the sender which can be used to fool both the human recipient as well as automated security tools.[4]

Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,[5][6] or install adversary-accessible remote management tools onto their computer (i.e., User Execution).[7]

ID: T1566
Sub-techniques:  T1566.001, T1566.002, T1566.003, T1566.004
Tactic: Initial Access
Platforms: Google Workspace, Linux, Office 365, SaaS, Windows, macOS
Contributors: Liora Itkin; Liran Ravich, CardinalOps; Ohad Zaidenberg, @ohad_mz; Philip Winther; Scott Cook, Capital One
Version: 2.4
Created: 02 March 2020
Last Modified: 08 September 2023

Procedure Examples

ID Name Description
G0001 Axiom

Axiom has used spear phishing to initially compromise victims.[8][9]

G0115 GOLD SOUTHFIELD

GOLD SOUTHFIELD has conducted malicious spam (malspam) campaigns to gain access to victim's machines.[10]

S0009 Hikit

Hikit has been spread through spear phishing.[9]

S1073 Royal

Royal has been spread through the use of phishing campaigns including "call back phishing" where victims are lured into calling a number provided through email.[11][12][13]

Mitigations

ID Mitigation Description
M1049 Antivirus/Antimalware

Anti-virus can automatically quarantine suspicious files.

M1031 Network Intrusion Prevention

Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity.

M1021 Restrict Web-Based Content

Determine if certain websites or attachment types (ex: .scr, .exe, .pif, .cpl, etc.) that can be used for phishing are necessary for business operations and consider blocking access if activity cannot be monitored well or if it poses a significant risk.

M1054 Software Configuration

Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.[14][15]

M1017 User Training

Users can be trained to identify social engineering techniques and phishing emails.

Detection

ID Data Source Data Component Detects
DS0015 Application Log Application Log Content

Monitor for third-party application logging, messaging, and/or other artifacts that may send phishing messages to gain access to victim systems. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.[14][15] URL inspection within email (including expanding shortened links) can help detect links leading to known malicious sites. Detonation chambers can be used to detect these links and either automatically go to these sites to determine if they're potentially malicious, or wait and capture the content if a user visits the link.

Monitor call logs from corporate devices to identify patterns of potential voice phishing, such as calls to/from known malicious phone numbers. Correlate these records with system events.

DS0022 File File Creation

Monitor for newly constructed files from a phishing messages to gain access to victim systems.

DS0029 Network Traffic Network Traffic Content

Monitor and analyze SSL/TLS traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)). Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.[14][15]

Network Traffic Flow

Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

References