T1534 — Internal Spearphishing

Tactic: Lateral Movement · Platforms: Linux, macOS, Office Suite, SaaS, Windows

After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is…

Sigma detection rules (5)

title: T1534 Internal Spearphishing
id: 7be87b3e-94e7-46e9-87e8-da26b9089d9c
description: 'Internal spearphishing (the phishing message itself, sent account-to-account) is not directly observable via Windows process or registry telemetry; this rule instead proxies via detecting script-interpreter or LOLBin child processes (cmd, powershell, wscript, cscript, mshta, rundll32, regsvr32) spawned from a mail or chat client (Outlook, Thunderbird, Teams, Slack), indicating a user opened a malicious attachment or link delivered by an internal phishing message. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, UserContext, AttachmentEntropyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1534
author: Shahrukh Khan
date: 2026-02-15
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1534

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '1'
    ParentImage|endswith:
      - '\OUTLOOK.EXE'
      - '\thunderbird.exe'
      - '\Teams.exe'
      - '\slack.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.
  - Legitimate mail-merge, macro, or add-in automation spawning scripting hosts from the mail/chat client.

level: medium

title: T1534 Internal Spearphishing
id: e4254bf7-e5c3-4559-8ed9-92377ae59873
description: 'Internal Spearphishing via Trusted Accounts. Internal spearphishing hinges on message content, recipient targeting, and compromised-account context that raw auditd process events cannot inspect; a bare CLI mail/mutt/sendmail invocation with a "-s" (subject) flag is present in essentially all legitimate automated mail (cron alerts, monitoring notifications) and provides no discriminating signal on its own. As a narrower single-event proxy, this rule requires an attachment flag alongside the subject flag AND that the sending process was launched by a real, interactively-logged-in user (auid resolved, not the auditd unset/service-process sentinel value), which is more consistent with a human-driven -- potentially compromised-account -- mail send than routine unattended automation. Tune using: SubjectLineAnomaly, AttachmentType.'
references:
  - https://attack.mitre.org/techniques/T1534
author: Shahrukh Khan
date: 2026-06-04
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1534

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/mutt'
      - '/mail'
      - '/sendmail'
  selection_attachment_a1:
    a1|contains: '-a'
  selection_attachment_a2:
    a2|contains: '-a'
  selection_attachment_a3:
    a3|contains: '-a'
  selection_subject_a1:
    a1|contains: '-s'
  selection_subject_a2:
    a2|contains: '-s'
  selection_subject_a3:
    a3|contains: '-s'
  filter_service_account:
    auid: '4294967295'
  condition: selection and (1 of selection_attachment_*) and (1 of selection_subject_*) and not filter_service_account

falsepositives:
  - Legitimate interactive users sending mail with attachments and subjects (e.g. sharing a document, forwarding a report); auditd cannot inspect message content or recipients, so real internal-spearphishing-vs-benign disambiguation still needs the mail server's own application/content logs.

level: medium

title: T1534 Internal Spearphishing
id: 8b155486-9128-46fe-b787-19b0d690298c
description: 'Internal Spearphishing via Trusted Accounts. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExecutionChainDepth, MailScriptFlag.'
references:
  - https://attack.mitre.org/techniques/T1534
author: Shahrukh Khan
date: 2026-04-19
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1534

logsource:
  product: macos

detection:
  selection:
    Image|endswith: '/osascript'
  selection_mail:
    CommandLine|contains:
      - 'tell application "Mail"'
      - 'send message'
  condition: selection and selection_mail

falsepositives:
  - Legitimate Mail.app automation scripts used for notifications and reporting invoke the same AppleScript send message calls, so this should be reviewed for whether the sender is a compromised internal account sending to multiple unrelated recipients.

level: medium

title: T1534 Internal Spearphishing
id: dfd7ca32-3737-45fb-9c4b-c959922921c0
description: 'Internal Spearphishing via Trusted Accounts. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: UserAnomalyThreshold, FileRiskScoring.'
references:
  - https://attack.mitre.org/techniques/T1534
author: Shahrukh Khan
date: 2026-05-03
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1534

logsource:
  product: saas
  service: slack

detection:
  selection_file_share:
    action: 'file_public_link_created'
  selection_workspace_export:
    action: 'workspace_export'

  condition: selection_file_share or selection_workspace_export

falsepositives:
  - Legitimate cross-team file sharing via public links or a sanctioned compliance-driven workspace export; user-anomaly and file-risk-scoring baselines are needed to reduce noise.

level: high

title: T1534 Internal Spearphishing
id: 9d70d0e4-b044-4496-ae7a-7c79654a74f3
description: 'Internal Spearphishing via Trusted Accounts. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: MacroExecutionWindow, AttachmentNameHeuristics.'
references:
  - https://attack.mitre.org/techniques/T1534
author: Shahrukh Khan
date: 2026-01-07
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1534

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_parent:
    ParentImage|endswith:
      - '\outlook.exe'
      - '\teams.exe'
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'

  selection_child:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
      - '\powershell.exe'
      - '\mshta.exe'

  selection_suspicious_cli:
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - '-enc'
      - '-EncodedCommand'
      - 'DownloadString'
      - 'DownloadFile'
      - 'IEX'
      - 'Invoke-Expression'
      - 'FromBase64String'
      - 'bitsadmin'

  condition: selection_parent and selection_child and selection_suspicious_cli

falsepositives:
  - Legitimate collaboration-tool add-ins or bots launching network-capable automation scripts — rare and worth reviewing regardless.
  - Help-desk or IT support macros that legitimately fetch signed installers over HTTPS.

level: high

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1534 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan