Spearphishing Attachment `T0865`

ICS Tactic: Initial Access

Authoring guide

These 5 rules share fields, values, and exclusions.

Fields filtered most (10 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`Action`	1	`ne` 1	`allow`
`Active`	1	`eq` 1	`true`
`DataverseActivity_TimeGenerated`	1	`cross_field_compare` 1	`ExpirationDateTime`
`Fields`	1	`contains` 1, `is_not_null` 1	`http`
`Message`	1	`in` 1	`Create`, `Update`
`Result`	1	`ne` 1	`safe`
`Scan Result`	1	`eq` 1	`malicious`
`Type`	1	`eq` 1	`email_ttp_ap`
`Url`	1	`is_not_null` 1
`mimecastEventId_s`	1	`eq` 1	`mail_ttp_attachment`

Top indicator values (10 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`Action`	`ne`	`allow` kustoMimecast Targeted Threat Protection - URL Protect	1
`Active`	`eq`	`true` kustoDataverse - TI map URL to DataverseActivity	1	70
`DataverseActivity_TimeGenerated`	`cross_field_compare`	`ExpirationDateTime` kustoDataverse - TI map URL to DataverseActivity	1	2
`Fields`	`contains`	`http` kustoDataverse - TI map URL to DataverseActivity	1
`Message`	`in`	`Create` kustoDataverse - TI map URL to DataverseActivity	1	2
`Message`	`in`	`Update` kustoDataverse - TI map URL to DataverseActivity	1	2
`Result`	`ne`	`safe` kustoMimecast Targeted Threat Protection - Attachment Protect	1
`Scan Result`	`eq`	`malicious` kustoMimecast Targeted Threat Protection - URL Protect	1
`Type`	`eq`	`email_ttp_ap` kustoMimecast Secure Email Gateway - Attachment Protect	1
`mimecastEventId_s`	`eq`	`mail_ttp_attachment` kustoMimecast Secure Email Gateway - Attachment Protect	1

Rules under this technique

These vendors publish rules tagged with this technique.

Kusto 5 rules