Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.
Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).[1][2] Another way to accomplish this is by Email Spoofing[3] the identity of the sender, which can be used to fool both the human recipient as well as automated security tools,[4] or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., "thread hijacking").[5]
Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,[6][7] or install adversary-accessible remote management tools onto their computer (i.e., User Execution).[8]
| ID | Name | Description |
|---|---|---|
| G0001 | Axiom |
Axiom has used spear phishing to initially compromise victims.[9][10] |
| G0115 | GOLD SOUTHFIELD |
GOLD SOUTHFIELD has conducted malicious spam (malspam) campaigns to gain access to victim's machines.[11] |
| S0009 | Hikit | |
| G1032 | INC Ransom |
INC Ransom has used phishing to gain initial access.[12][13] |
| S1139 | INC Ransomware |
INC Ransomware campaigns have used spearphishing emails for initial access.[13] |
| G0094 | Kimsuky |
Kimsuky has used spearphishing to gain initial access and intelligence.[14][15] |
| S1073 | Royal |
Royal has been spread through the use of phishing campaigns including "call back phishing" where victims are lured into calling a number provided through email.[16][17][18] |
| G1041 | Sea Turtle |
Sea Turtle used spear phishing to gain initial access to victims.[19] |
| ID | Mitigation | Description |
|---|---|---|
| M1049 | Antivirus/Antimalware |
Anti-virus can automatically quarantine suspicious files. |
| M1047 | Audit |
Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses. |
| M1031 | Network Intrusion Prevention |
Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity. |
| M1021 | Restrict Web-Based Content |
Determine if certain websites or attachment types (ex: .scr, .exe, .pif, .cpl, etc.) that can be used for phishing are necessary for business operations and consider blocking access if activity cannot be monitored well or if it poses a significant risk. |
| M1054 | Software Configuration |
Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.[20][21] |
| M1017 | User Training |
Users can be trained to identify social engineering techniques and phishing emails. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0015 | Application Log | Application Log Content |
Monitor for third-party application logging, messaging, and/or other artifacts that may send phishing messages to gain access to victim systems. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.[20][21] URL inspection within email (including expanding shortened links) can help detect links leading to known malicious sites. Detonation chambers can be used to detect these links and either automatically go to these sites to determine if they're potentially malicious, or wait and capture the content if a user visits the link. Monitor call logs from corporate devices to identify patterns of potential voice phishing, such as calls to/from known malicious phone numbers. Correlate these records with system events. Analytic 1 - Detecting Malicious Phishing Emails
|
| DS0022 | File | File Creation |
Monitor for creation of suspicious email attachments in download directories, execution of phishing attachments (e.g., .docm, .lnk, .hta, .vbs), or files extracted from .zip, .rar, .iso containers that execute scripts. Analytic 1 - Detecting Malicious File Creation from Phishing Emails
|
| DS0029 | Network Traffic | Network Traffic Content |
Monitor for clicking on malicious links leading to credential phishing, traffic to newly registered or suspicious domains, malicious redirect chains embedded in emails, or downloading of executables from phishing sites. Analytic 1 - Detecting Phishing Link Clicks in Emails
|
| Network Traffic Flow |
Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analytic 1 - Detecting Malicious Network Traffic Post-Phishing Execution
|