Phishing: Spearphishing via Service T1566.003

Tactic: Initial Access

Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.

Authoring guide

These 2 rules share fields, values, and exclusions.

Fields filtered most (13 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
data_stream.dataset2eq 2microsoft_exchange_online_message_trace.log, o365.audit
event.outcome2eq 1, in 1success, unknown
EventType1eq 1chatcreated
Provider_Name1eq 1microsoftteams
email.from.address1eq 1azure-noreply@microsoft.com
email.subject1contains 1amount due, azure monitor alert, bank account
o365.audit.CommunicationType1eq 1oneonone
o365.audit.Members1in 1help desk, help desk it, help desk team
o365.audit.ParticipantInfo.HasForeignTenantUsers1eq 1true
o365.audit.ParticipantInfo.HasGuestUsers1eq 1false
o365.audit.ParticipantInfo.HasOtherGuestUsers1eq 1false
user1contains 1help-desk, helpdesk, ithelp
user.email1contains 1help-desk, help.desk, help_desk

Top indicator values (54 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
EventTypeeq
chatcreated
1
Provider_Nameeq
microsoftteams
12
data_stream.dataseteq
microsoft_exchange_online_message_trace.log
1
data_stream.dataseteq
o365.audit
147
email.from.addresseq
azure-noreply@microsoft.com
1
email.subjectcontains
amount due
1
email.subjectcontains
azure monitor alert
1
email.subjectcontains
bank account
1
email.subjectcontains
billing
1
email.subjectcontains
charge
1
email.subjectcontains
credit card
1
email.subjectcontains
financial
1
email.subjectcontains
funds
1
email.subjectcontains
inv-
1
email.subjectcontains
invoice
1
email.subjectcontains
order-
1
email.subjectcontains
overdue
1
email.subjectcontains
past due
1
email.subjectcontains
payment
1
email.subjectcontains
purchase
1
email.subjectcontains
receipt
1
email.subjectcontains
refund
1
email.subjectcontains
remittance
1
email.subjectcontains
renewal
1
email.subjectcontains
subscription
1
email.subjectcontains
transaction
1
email.subjectcontains
wire transfer
1
event.outcomeeq
success
1375
event.outcomein
success
12
event.outcomein
unknown
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Microsoft 365

Domain: Cloud

Elastic 2 rules