T1566.001 — Spearphishing Attachment

Tactic: Initial Access · Platforms: Linux, macOS, Windows

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware…

Sub-technique of Phishing (T1566).

Sigma detection rules (3)

T1566.001 Phishing: Spearphishing Attachment

title: "T1566.001 Phishing: Spearphishing Attachment"
id: f249a1e8-db15-446a-aa2d-1d891abb5a9e
description: 'Detection Strategy for Spearphishing Attachment: Outlook writing a saved attachment with an executable/script/archive/macro-document extension into its local attachment cache (Content.Outlook), the concrete file-system artifact this technique leaves prior to User Execution. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: AttachmentExtensions, SuspiciousParentChildPairs, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1566/001
author: Shahrukh Khan
date: 2026-03-01
license: MIT
tags:
  - attack.initial-access
  - attack.t1566.001

logsource:
  category: file_event
  product: windows

detection:
  selection:
    Image|endswith: '\OUTLOOK.EXE'
    TargetFilename|contains: '\Content.Outlook\'
    TargetFilename|endswith:
      - '.exe'
      - '.scr'
      - '.js'
      - '.jse'
      - '.vbs'
      - '.hta'
      - '.chm'
      - '.iso'
      - '.img'
      - '.lnk'
      - '.docm'
      - '.xlsm'
      - '.pptm'
      - '.zip'
      - '.rar'
      - '.7z'

  condition: selection

falsepositives:
  - Legitimate email attachments in the same extension classes (archives, macro-enabled Office documents, ISO shares); tune with an AttachmentExtensions allowlist and SuspiciousParentChildPairs for downstream execution.

level: medium

T1566.001 Phishing: Spearphishing Attachment

title: "T1566.001 Phishing: Spearphishing Attachment"
id: ff4322ca-a1ce-48ab-af84-de10160fc344
description: 'Detection Strategy for Spearphishing Attachment across OS Platforms. (Retargeted to the process_creation auditd telemetry that actually captures this technique''s behavior; see logsource below.) Replaces the prior directory-path heuristic, which also matched legitimate downloaded-script execution, with a correlation between interpreter execution and a parent process that is an actual mail client/MUA, so the alert requires the interpreter to have been spawned directly from an email client rather than merely running from /tmp or Downloads. Both selectors reference the same auditd SYSCALL record type explicitly. Tune using: MUAProcessList, ScriptInterpreters.'
references:
  - https://attack.mitre.org/techniques/T1566/001
author: Shahrukh Khan
date: 2026-03-07
license: MIT
tags:
  - attack.initial-access
  - attack.t1566.001

logsource:
  category: process_creation
  product: linux

detection:
  selection_interp:
    type: SYSCALL
    syscall: execve
    exe|endswith:
      - '/bash'
      - '/sh'
      - '/python3'
      - '/perl'
  selection_parent_mua:
    type: SYSCALL
    ParentImage|endswith:
      - '/thunderbird'
      - '/evolution'
      - '/mutt'
      - '/neomutt'
      - '/claws-mail'
      - '/kmail'
      - '/geary'
      - '/mailx'
      - '/alpine'

  condition: selection_interp and selection_parent_mua

falsepositives:
  - 'Power users who manually configure their mail client to open attachments with a custom script handler, or MUA plugins that legitimately shell out to an interpreter (e.g. a calendar-invite or filter script); scope MUAProcessList/ScriptInterpreters to the organization''s approved mail clients and remove uncommon MUAs as needed.'

level: high

T1566.001 Phishing: Spearphishing Attachment

title: "T1566.001 Phishing: Spearphishing Attachment"
id: 86fe2a30-5103-4686-9974-60bc69086dba
description: 'Detection Strategy for Spearphishing Attachment across OS Platforms. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExecutionDelayThreshold, SuspiciousParentApps.'
references:
  - https://attack.mitre.org/techniques/T1566/001
author: Shahrukh Khan
date: 2026-02-05
license: MIT
tags:
  - attack.initial-access
  - attack.t1566.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|endswith: '/Mail.app/Contents/MacOS/Mail'
    Image|endswith:
      - '/bash'
      - '/zsh'
      - '/osascript'
      - '/curl'

  condition: selection

falsepositives:
  - Rare legitimate Mail rules that shell out through AppleScript for approved automated triage of incoming messages.

level: high

Related sub-techniques

Explore