Internal Spearphishing T1534

Tactic: Lateral Movement

After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is initially compromised either by controlling the user's device or by compromising the account credentials of the user. Adversaries may then attempt to take advantage of the trusted internal account to increase the likelihood of tricking more victims into falling for phish attempts, often incorporating Impersonation.

Authoring guide

These 4 rules share fields, values, and exclusions.

Fields filtered most (11 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
EventOriginalType1eq 1PowerAppPermissionEdited
EventType1eq 1publish
InvitedId1is_not_null 1
OperationName1eq 1Invite external user
Provider_Name1eq 1sns.amazonaws.com
Result1eq 1success
SourceSystem1eq 1azure ad
Type1eq 1email_iep
data_stream.dataset1eq 1aws.cloudtrail
event.outcome1eq 1success
mimecastEventId_s1eq 1mail_ttp_iep

Top indicator values (10 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
EventOriginalTypeeq
PowerAppPermissionEdited
1
EventTypeeq
publish
1
OperationNameeq
Invite external user
1
Provider_Nameeq
sns.amazonaws.com
13
Resulteq
success
131
SourceSystemeq
azure ad
1
Typeeq
email_iep
1
data_stream.dataseteq
aws.cloudtrail
1169
event.outcomeeq
success
1369
mimecastEventId_seq
mail_ttp_iep
1

Exclusions (1 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
InvitedOrgDomaincontains
allowed_domains
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Elastic 1 rule

Kusto 3 rules