Phishing T1566

Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.

Events covered

27 catalog events are tagged with this technique by at least one rule.

ProviderEventTitle
SysmonEvent ID 1Process creation
SysmonEvent ID 3Network connection
SysmonEvent ID 7Image loaded
SysmonEvent ID 11FileCreate
SysmonEvent ID 12RegistryEvent (Object create and delete)
SysmonEvent ID 13RegistryEvent (Value Set)
SysmonEvent ID 14RegistryEvent (Key and Value Rename)
SysmonEvent ID 22DNSEvent (DNS query)
Security-AuditingEvent ID 4656A handle to an object was requested.
Security-AuditingEvent ID 4663An attempt was made to access an object.
Security-AuditingEvent ID 4688A new process has been created.
Security-AuditingEvent ID 5379Credential Manager credentials were read.
Defender-DeviceEventsanyDefender event (any)
Defender-DeviceFileEventsFileCreatedFile created
Defender-DeviceFileEventsFileRenamedFile renamed
Defender-DeviceProcessEventsanyProcess activity (any)
Defender-DeviceProcessEventsProcessCreatedProcess created
Windows-DefenderEvent ID 1121Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator.
Windows-DefenderEvent ID 1122Microsoft Defender Exploit Guard audited an operation that is not allowed by your IT administrator.
Windows-DefenderEvent ID 1125Your IT administrator would have caused Microsoft Defender Exploit Guard to block a potentially dangerous network connection.
Windows-DefenderEvent ID 1126Your IT administrator has caused Microsoft Defender Exploit Guard to block a potentially dangerous network connection.
Windows-DefenderEvent ID 1129A user has allowed a blocked Microsoft Defender Exploit Guard operation.
Windows-DefenderEvent ID 1131ProductName has blocked an operation that your administrator doesn't allow.
Windows-DefenderEvent ID 1132ProductName has audited an operation.
Windows-DefenderEvent ID 1133ProductName has blocked an operation that your administrator doesn't allow.
Windows-DefenderEvent ID 1134ProductName has audited an operation.
Windows-DefenderEvent ID 5007Product Name Configuration has changed.

Authoring guide

Patterns shared across the 83 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (44 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
process_name28eq 21, in 8excel.exe, eqnedt32.exe, graph.exe, arp.exe, atbroker.exe
parent_process_name24eq 13, in 9, match 2excel.exe, EQNEDT32.exe, Graph.exe, explorer.exe, powerpnt.exe
Image19ends_with 12, wildcard 4, contains 3, in 1, starts_with 1\brave.exe, \certutil.exe, \chrome.exe, \cmd.exe, \cscript.exe
event.type19eq 19, ne 1start, creation, deletion
TargetFilename16contains 9, ends_with 9, match 3, in 2, wildcard 1.docm, .dotm, .iso, .potm, (?i)((\x5cappdata\x5clocal\x5cmicrosoft\x5cwindows\x5c.*\...
EventID14eq 11, in 31, 7, 1121, 1122, 1125
ParentImage11ends_with 8, eq 2, in 1\winword.exe, ?:\windows\system32\mmc.exe, \7zfm.exe, \cscript.exe, \eqnedt32.exe
CommandLine10contains 6, match 2, ends_with 1, in 1, ne 1(?i)((\x5cAppData\x5cLocal\x5cMicrosoft\x5cWindows\x5c.*\..., .exe, *.dll*, *http:*, *https:*
file_name10ends_with 4, in 3, eq 1, match 1, ne 1(?i)\.rdp$, *.cab, *.dll, *.exe, *.img.lnk
OriginalFileName9eq 5, in 4cmd.exe, bitsadmin.exe, certutil.exe, cscript.exe, eqnedt32.exe
EventType7eq 5, contains 1, in 1, starts_with 1start, Image loaded, ProcessCreated, connection_attempted, creation
file.extension6eq 6appinstaller, application, appx, exe, htm
process.args6wildcard 4, contains 2, eq 2--single-argument, -url, .+\.(wll|xll|ppa|ppam|xla|xlam|vsto), /V, ?:\ProgramData\*
ImageLoaded3in 2, ends_with 1*\\ie.interop.mshtml.dll, *\\microsoft.mshtml.dll, *\\mshtml.dll, *\\vbe7.dll, *\\vbe7intl.dll
event_action3eq 3created

Top indicator values (670 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
event.typeeq
start
15241
process_nameeq
mshta.exe
728
process_nameeq
powershell.exe
799
process_nameeq
cscript.exe
622
process_nameeq
wscript.exe
626
process_nameeq
cmd.exe
575
parent_process_namein
excel.exe
612
parent_process_namein
onenote.exe
67
parent_process_namein
onenotem.exe
66
parent_process_namein
powerpnt.exe
611
parent_process_namein
winword.exe
612
parent_process_namein
EQNEDT32.exe
55
parent_process_namein
Graph.exe
55
parent_process_namein
msaccess.exe
55
parent_process_namein
mspub.exe
55
parent_process_namein
onenoteim.exe
55
parent_process_namein
outlook.exe
57
parent_process_namein
visio.exe
55
parent_process_namein
winproj.exe
55
process_namein
eqnedt32.exe
55
process_namein
excel.exe
55
process_namein
graph.exe
55
process_namein
msaccess.exe
55
process_namein
mspub.exe
55
process_namein
onenote.exe
55
process_namein
onenoteim.exe
55
process_namein
onenotem.exe
55
process_namein
outlook.exe
55
process_namein
powerpnt.exe
55
process_namein
visio.exe
55

Exclusions (155 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
process.code_signature.trustedeq
true
4
Imagewildcard
?:\program files\*.exe
3
Imagewildcard
?:\program files (x86)\*.exe
2
Imagewildcard
?:\windows\system32\notepad.exe
2
process_nameeq
rundll32.exe
3
process.code_signature.subject_nameeq
Citrix Systems, Inc.
2
CommandLinecontains
immersivecontrolpanel
1
CommandLineends_with
-Embedding
1
CommandLinestarts_with
"C:\WINDOWS\system32\mmc.exe" "C:\Windows\System32\gpme.msc" /s /gpobject:"LDAP://
1
Detailsends_with
system32\wbem\wbemsvc.dll
1
Detailsends_with
system32\wbem\wmiutils.dll
1
Imagecontains
\appdata\local\microsoft\onedrive\
1
Imageends_with
\appdata\local\microsoft\teams\current\teams.exe
1
Imageends_with
\cmd.exe
1
Imageends_with
\excel.exe
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 25 rules

Elastic 23 rules

Splunk 30 rules

Kusto 5 rules