T1566.002 — Spearphishing Link

Tactic: Initial Access · Platforms: Identity Provider, Linux, macOS, Office Suite, SaaS, Windows

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in…

Sub-technique of Phishing (T1566).

Sigma detection rules (4)

title: "T1566.002 Phishing: Spearphishing Link"
id: 977338fc-8b3b-42f7-8f2a-1dcb525f0060
description: 'Detection Strategy for Spearphishing Links. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: SuspiciousTLDs, URLShortenerDomains, ClickToExecutionWindow.'
references:
  - https://attack.mitre.org/techniques/T1566/002
author: Shahrukh Khan
date: 2026-01-09
license: MIT
tags:
  - attack.initial-access
  - attack.t1566.002

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection_dns_shortener:
    EventID: '22'
    QueryName|contains:
      - 'bit.ly'
      - 'tinyurl.com'
      - 't.co'
      - 'goo.gl'
      - 'ow.ly'
      - 'is.gd'
      - 'buff.ly'
      - 'rebrand.ly'
      - 'cutt.ly'
      - 'rb.gy'
      - 'tiny.cc'

  selection_dns_tld:
    EventID: '22'
    QueryName|endswith:
      - '.tk'
      - '.ml'
      - '.ga'
      - '.cf'
      - '.gq'
      - '.xyz'
      - '.top'
      - '.click'
      - '.link'
      - '.zip'
      - '.mov'

  selection_conn_shortener:
    EventID: '3'
    DestinationHostname|contains:
      - 'bit.ly'
      - 'tinyurl.com'
      - 't.co'
      - 'goo.gl'
      - 'ow.ly'
      - 'is.gd'
      - 'buff.ly'
      - 'rebrand.ly'
      - 'cutt.ly'
      - 'rb.gy'
      - 'tiny.cc'

  selection_conn_tld:
    EventID: '3'
    DestinationHostname|endswith:
      - '.tk'
      - '.ml'
      - '.ga'
      - '.cf'
      - '.gq'
      - '.xyz'
      - '.top'
      - '.click'
      - '.link'
      - '.zip'
      - '.mov'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: (1 of selection_*) and not filter_system_account

falsepositives:
  - Legitimate marketing/newsletter emails or partner communications using URL shorteners.

level: medium

title: "T1566.002 Phishing: Spearphishing Link"
id: ac5de0d9-b1e4-4379-951b-8c45bf2638cd
description: 'Detection Strategy for Spearphishing Links. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Fixed: this rule alone now only captures a browser or mail client being launched with a URL argument; it is the first half of a session-correlated pair (see d3f8a1c2-5e7b-4a6d-9f3c-1b2e8d4a6c95 and the temporal_ordered correlation companion) that ties the link-open to a subsequent interpreter execution in the same auditd session, instead of matching any co-occurring EXECVE regardless of process lineage. Tune using: MonitoredBrowsers, PhishingIndicators.'
references:
  - https://attack.mitre.org/techniques/T1566/002
author: Shahrukh Khan
date: 2026-04-09
modified: 2026-07-26
license: MIT
tags:
  - attack.initial-access
  - attack.t1566.002

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/firefox'
      - '/google-chrome'
      - '/thunderbird'
    a1|contains: 'http'

  condition: selection

falsepositives:
  - Ordinary link-clicking in a browser or mail client is extremely common and is expected to match this half of the pair on its own; real signal requires the paired interpreter-execution rule to also fire in the same auditd session shortly afterward.

level: low
---
title: "T1566.002 Phishing: Spearphishing Link - Interpreter Execution Following Link Click"
id: d3f8a1c2-5e7b-4a6d-9f3c-1b2e8d4a6c95
description: 'Companion to ac5de0d9-b1e4-4379-951b-8c45bf2638cd: detects a shell or Python interpreter executed shortly after a browser/mail client opened a URL, the second half of the phishing-link click-through chain for T1566.002. Paired via the temporal_ordered correlation rule below using the auditd session id (ses) as an approximation of process lineage, since raw EXECVE/SYSCALL records do not expose a parent-process-image field for a direct ppid-to-exe join. Tune using: MonitoredBrowsers, PhishingIndicators.'
references:
  - https://attack.mitre.org/techniques/T1566/002
author: Shahrukh Khan
date: 2026-04-09
modified: 2026-07-26
license: MIT
tags:
  - attack.initial-access
  - attack.t1566.002

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/bash'
      - '/sh'
      - '/python3'

  condition: selection

falsepositives:
  - An interpreter running around the same time as browsing is common in normal desktop use (package manager hooks, background scripts); on its own this selection carries no phishing-specific signal.

level: low
---
title: "T1566.002 Phishing: Spearphishing Link - Browser-to-Script Chain"
id: e6a2c9f4-8b1d-47e3-9a5c-3f7d2b1e6a84
description: 'Correlation companion linking ac5de0d9-b1e4-4379-951b-8c45bf2638cd and d3f8a1c2-5e7b-4a6d-9f3c-1b2e8d4a6c95: fires when a browser/mail client opens a URL and, within the same auditd session (ses), an interpreter subsequently runs within a 5-minute window, approximating the actual phishing-link click-through-to-execution chain that the original single-rule co-occurrence heuristic could not express.'
status: experimental
correlation:
  type: temporal_ordered
  rules:
    - ac5de0d9-b1e4-4379-951b-8c45bf2638cd
    - d3f8a1c2-5e7b-4a6d-9f3c-1b2e8d4a6c95
  group-by:
    - ses
  timespan: 5m
  condition: "ac5de0d9-b1e4-4379-951b-8c45bf2638cd and d3f8a1c2-5e7b-4a6d-9f3c-1b2e8d4a6c95"
level: high

title: "T1566.002 Phishing: Spearphishing Link"
id: e25db503-38ae-4bb1-a9a6-e118539d64d8
description: 'Detection Strategy for Spearphishing Links. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CertificateAnomalies, ExecutionDelayThreshold.'
references:
  - https://attack.mitre.org/techniques/T1566/002
author: Shahrukh Khan
date: 2026-06-27
license: MIT
tags:
  - attack.initial-access
  - attack.t1566.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|endswith:
      - '/Safari.app/Contents/MacOS/Safari'
      - '/Mail.app/Contents/MacOS/Mail'
    Image|endswith:
      - '/bash'
      - '/curl'
      - '/osascript'

  condition: selection

falsepositives:
  - Browser extensions or approved download managers that spawn helper shell processes after a user clicks a legitimate link.

level: high

title: "T1566.002 Phishing: Spearphishing Link"
id: 6deda9c7-0d72-4709-96a8-88b0b33f5919
description: 'Detection Strategy for Spearphishing Links. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: AllowedApps, AnomalousConsentPatterns.'
references:
  - https://attack.mitre.org/techniques/T1566/002
author: Shahrukh Khan
date: 2026-05-24
license: MIT
tags:
  - attack.initial-access
  - attack.t1566.002

logsource:
  product: azure
  service: signinlogs

detection:
  selection:
    AppDisplayName|contains:
      - 'DocuSign'
      - 'Adobe'
      - 'SharePoint Online'
    ResultType: '0'
  filter_allowed:
    ConditionalAccessStatus: 'success'
  condition: selection and not filter_allowed

falsepositives:
  - Legitimate use of newly adopted third-party productivity applications that have not yet been added to the approved application allowlist.

level: medium

Related sub-techniques

• T1566.003 Spearphishing via Service
• T1566.004 Spearphishing Voice
• T1566.001 Spearphishing Attachment

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1566.002 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan