T1566.004 — Spearphishing Voice

Tactic: Initial Access · Platforms: Linux, macOS, Windows, Identity Provider

Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone…

Sub-technique of Phishing (T1566).

Sigma detection rules (4)

T1566.004 Phishing: Spearphishing Voice

title: "T1566.004 Phishing: Spearphishing Voice"
id: 7bf02e05-5081-407a-a233-c9096f93e3f1
description: 'Detection Strategy for Spearphishing Voice across OS platforms. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: PhoneNumberBlocklist, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1566/004
author: Shahrukh Khan
date: 2026-05-07
license: MIT
tags:
  - attack.initial-access
  - attack.t1566.004

logsource:
  product: saas
  service: telephony

detection:
  selection_blocklist:
    blocklisted: true
  selection_reputation:
    numberReputation: 'high-risk'

  condition: 1 of selection_*

falsepositives:
  - Reputation feeds frequently misclassify legitimate business numbers, and vishing over voice channels leaves almost no reliable telemetry so this rule cannot confirm social engineering intent.

level: low

T1566.004 Phishing: Spearphishing Voice

title: "T1566.004 Phishing: Spearphishing Voice"
id: 26b0c777-e0bb-4fa5-a84d-21defa387fbf
description: 'Spearphishing Voice (vishing) is a social-engineering technique whose actual indicators - the phone call itself, the caller''s pretext, and the victim being talked through an action - occur off-host and are not observable in any Linux auditd or syslog telemetry; auditd cannot see VoIP/softphone call metadata, call direction, or spoken content, so this technique is not meaningfully detectable at the Linux host layer. This rule does not attempt to detect the call itself. As the closest defensible Linux-observable proxy, it instead flags execution of Remote Monitoring & Management (RMM) tools that vishing campaigns (e.g. Luna Moth, per CISA/Unit42 reporting) commonly instruct victims to install during the call; this is a downstream side effect, not the vishing act, and should be triaged only as a weak, corroborating signal. Tune using: KnownRMMAllowList, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1566/004
author: Shahrukh Khan
date: 2026-06-08
license: MIT
tags:
  - attack.initial-access
  - attack.t1566.004

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/anydesk'
      - '/AnyDesk'
      - '/teamviewer'
      - '/rustdesk'

  condition: selection

falsepositives:
  - IT support staff and legitimate remote-assistance sessions install/launch the same RMM tools; auditd cannot associate this event with a preceding phone call at all, so this is at best a weak corroborating indicator - scope KnownRMMAllowList to sanctioned support tooling and correlate with helpdesk ticketing/UserContext.

level: informational

T1566.004 Phishing: Spearphishing Voice

title: "T1566.004 Phishing: Spearphishing Voice"
id: 66c8203f-b086-4520-8c29-b163bfb4912c
description: 'Detection Strategy for Spearphishing Voice across OS platforms. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CallerIDPatterns, PayloadCorrelation.'
references:
  - https://attack.mitre.org/techniques/T1566/004
author: Shahrukh Khan
date: 2026-04-30
license: MIT
tags:
  - attack.initial-access
  - attack.t1566.004

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/screensharingd'
      - '/AnyDesk'
      - '/TeamViewer'
    ParentImage|endswith: '/FaceTime.app/Contents/MacOS/FaceTime'

  condition: selection

falsepositives:
  - Voice phishing itself happens over a phone call with no macOS artifact; this rule can only catch a follow-on remote-access tool launch and will miss most vishing incidents entirely, while legitimate IT remote support sessions look identical.

level: medium

T1566.004 Phishing: Spearphishing Voice

title: "T1566.004 Phishing: Spearphishing Voice"
id: 0a4caf48-3dd0-4289-a114-d5bfa98169db
description: 'Detection Strategy for Spearphishing Voice across OS platforms. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: MFARequestThreshold, ConsentGrantPatterns.'
references:
  - https://attack.mitre.org/techniques/T1566/004
author: Shahrukh Khan
date: 2026-01-25
license: MIT
tags:
  - attack.initial-access
  - attack.t1566.004

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation:
      - 'Consent to application'
      - 'Add OAuth2PermissionGrant'
  selection_scope:
    Parameters.Value|contains:
      - 'Mail.Read'
      - 'Mail.Send'
      - 'offline_access'
  condition: selection and selection_scope

falsepositives:
  - Employees legitimately granting consent to approved productivity applications that request mail scopes for calendar or email integration.

level: high

Related sub-techniques

Explore