Spearphishing Attachment T0865

ICS Tactic: Initial Access

Authoring guide

These 5 rules share fields, values, and exclusions.

Fields filtered most (4 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
Active1eq 1true
Result1ne 1safe
Type1eq 1email_ttp_ap
mimecastEventId_s1eq 1mail_ttp_attachment

Top indicator values (4 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
Activeeq
true
160
Resultne
safe
1
Typeeq
email_ttp_ap
1
mimecastEventId_seq
mail_ttp_attachment
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Kusto 5 rules