ATT&CK coverage › Technique
Phishing: Spearphishing Attachment T1566.001
Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Events covered
20 catalog events are tagged with this technique by at least one rule.
Authoring guide
Patterns shared across the 30 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (16 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (328 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.
Common exclusions (2 distinct)
Field/operator/value combinations that rules under this technique routinely exclude (top-level not() clauses). These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 17 rules
- Arbitrary Shell Command Execution Via Settingcontent-Ms
- HTML Help HH.EXE Suspicious Child Process
- ISO File Created Within Temp Folders
- ISO Image Mounted
- ISO or Image Mount Indicator in Recent Files
- Office Macro File Creation
- Office Macro File Creation From Suspicious Process
- Office Macro File Download
- Password Protected ZIP File Opened (Email Attachment)
- Potential Initial Access via DLL Search Order Hijacking
- Suspicious Double Extension File Execution
- Suspicious Execution From Outlook Temporary Folder
- Suspicious File Created in Outlook Temporary Directory
- Suspicious HH.EXE Execution
- Suspicious HWP Sub Processes
- Suspicious Microsoft OneNote Child Process
- Windows Registry Trust Record Modification
Splunk 13 rules
- Detect Outlook exe writing a zip file
- Windows CAB File on Disk
- Windows Defender ASR Audit Events
- Windows Defender ASR Block Events
- Windows Defender ASR Rules Stacking
- Windows ISO LNK File Creation
- Windows Office Product Dropped Cab or Inf File
- Windows Office Product Dropped Uncommon File
- Windows Office Product Loaded MSHTML Module
- Windows Office Product Loading Taskschd DLL
- Windows Office Product Loading VBE7 DLL
- Windows Phishing Recent ISO Exec Registry
- Windows Spearphishing Attachment Connect To None MS Office Domain