T1566.003 — Spearphishing via Service

Tactic: Initial Access · Platforms: Linux, macOS, Windows

Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than…

Sub-technique of Phishing (T1566).

Sigma detection rules (3)

T1566.003 Phishing: Spearphishing via Service

title: "T1566.003 Phishing: Spearphishing via Service"
id: 92f1e4d2-3c95-49ff-8724-deea5497ada3
description: 'Detection Strategy for Spearphishing via a Service across OS Platforms. (Retargeted from the original process_creation label to file_event — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: MonitoredServices, SuspiciousProcessPatterns, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1566/003
author: Shahrukh Khan
date: 2026-05-18
license: MIT
tags:
  - attack.initial-access
  - attack.t1566.003

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    ParentImage|endswith:
      - '\teams.exe'
      - '\slack.exe'
    TargetFilename|endswith:
      - '.exe'
      - '.hta'
      - '.js'

  condition: selection

falsepositives:
  - Legitimate file-sharing of executables/scripts between colleagues via a sanctioned collaboration platform (uncommon but not impossible in dev-heavy teams).

level: high

T1566.003 Phishing: Spearphishing via Service

title: "T1566.003 Phishing: Spearphishing via Service"
id: e1c42e79-9dbd-492d-a7ed-3b4be869b2b2
description: 'Detection Strategy for Spearphishing via a Service across OS Platforms. Spearphishing via a third-party service (webmail, social media DM, etc.) is fundamentally a content/recipient/service-layer technique that Linux auditd process telemetry cannot observe, and a genuine parent-child process relationship between a browser and a spawned interpreter requires cross-event PID/PPID correlation that a single Sigma detection block cannot express -- the previous version simply required a browser process and a shell/python/office process to exist independently anywhere in the log, with no actual linkage. As the closest defensible single-event proxy, this rule instead flags script/document-handler interpreters whose own argv path points into a browser download or profile-cache directory, indicating a file retrieved through a browser session was subsequently run. Tune using: BrowserProcesses, PhishingIndicators.'
references:
  - https://attack.mitre.org/techniques/T1566/003
author: Shahrukh Khan
date: 2026-03-16
license: MIT
tags:
  - attack.initial-access
  - attack.t1566.003

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/bash'
      - '/sh'
      - '/python3'
      - '/soffice.bin'
  selection_staging_path:
    a1|contains:
      - '/Downloads/'
      - '/.cache/mozilla/'
      - '/.mozilla/firefox/'
      - '/.cache/google-chrome/'
      - '/.config/google-chrome/'
      - '/.cache/chromium/'
  condition: selection and selection_staging_path

falsepositives:
  - Legitimate execution of scripts or documents a user deliberately saved from a browser download is far more common than actual spearphishing-via-service delivery; genuine phishing-vs-benign disambiguation needs email/web-gateway content and sender/service reputation data that auditd cannot provide.

level: low

T1566.003 Phishing: Spearphishing via Service

title: "T1566.003 Phishing: Spearphishing via Service"
id: de57732e-f5db-4e34-9932-01889428d805
description: 'Detection Strategy for Spearphishing via a Service across OS Platforms. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CertificateChecks, ExecutionDelay.'
references:
  - https://attack.mitre.org/techniques/T1566/003
author: Shahrukh Khan
date: 2026-04-11
license: MIT
tags:
  - attack.initial-access
  - attack.t1566.003

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|endswith:
      - '/Slack.app/Contents/MacOS/Slack'
      - '/Microsoft Teams.app/Contents/MacOS/Teams'
    Image|endswith:
      - '/bash'
      - '/osascript'
      - '/curl'

  condition: selection

falsepositives:
  - Approved chat-app integrations or bots that legitimately trigger local helper scripts, which are uncommon but do exist in some enterprise deployments.

level: high

Related sub-techniques

Explore