Phishing: Spearphishing Link T1566.002

Tactic: Initial Access

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.

Events covered

18 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 57 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (107 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
data_stream.dataset19eq 16, in 3azure.signinlogs, o365.audit, azure.activitylogs, google_workspace.token, azure.auditlogs
EventType16eq 15, contains 1, in 1Sign-in activity, UserLoggedIn, start, authorize, Add registered users to device.
event.outcome10eq 9, in 1success, Success, failure
event.type8eq 8, ne 1start, creation, deletion
EventID7in 5, eq 21121, 1122, 1125, 1126, 1
process_name7eq 7, in 1cscript.exe, excel.exe, brave.exe, browser.exe, certreq.exe
Operation5eq 5AlertEntityGenerated, TIMailData, AdminSubmission
Workload5eq 5SecurityComplianceCenter, ThreatIntelligence
azure_ad::app_id5eq 3, in 229d9ed98-a469-4536-ade2-f981bc1d605e, 00b41c95-dab0-4487-9791-b9d2c32c80f2, 04b07795-8ddb-461a-bbee-02f9e1bf7b46, 0ec893e0-5785-4de6-99da-4ed124e5296c
file.extension5eq 5appinstaller, application, appx, exe, htm
parent_process_name5eq 3, in 2excel.exe, powerpnt.exe, chrome.exe, explorer.exe, firefox.exe
sourcetype5eq 5o365:management:activity, azure:monitor:aad
ParentImage4eq 2, ends_with 1, in 1/script editor, ?:\windows\system32\mmc.exe, c:\program files\internet explorer\iediagcmd.exe, chrome.exe, firefox.exe
azure_ad::resource_id4eq 3, in 300000002-0000-0000-c000-000000000000, 00000003-0000-0000-c000-000000000000, 00000002-0000-0ff1-ce00-000000000000, 00000003-0000-0ff1-ce00-000000000000, 00000005-0000-0ff1-ce00-000000000000
Image3contains 1, ends_with 1, is_not_null 1, wildcard 1/bash, /chmod, /curl, ?:\users\*\downloads\*

Top indicator values (411 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
data_stream.dataseteq
azure.signinlogs
830
data_stream.dataseteq
o365.audit
545
event.outcomeeq
success
8251
event.typeeq
start
5606
event.typeeq
creation
345
EventTypeeq
Sign-in activity
46
EventTypeeq
UserLoggedIn
36
EventTypeeq
start
316
EventTypeeq
authorize
23
sourcetypeeq
o365:management:activity
480
EventIDin
1126
33
EventIDin
1121
22
EventIDin
1122
22
EventIDin
1125
22
EventIDin
1129
22
EventIDin
1131
22
EventIDin
1132
22
EventIDin
1133
22
EventIDin
1134
22
Workloadeq
SecurityComplianceCenter
38
Workloadeq
ThreatIntelligence
23
azure_ad::app_ideq
29d9ed98-a469-4536-ade2-f981bc1d605e
37
azure_ad::authentication_protocoleq
deviceCode
33
data_stream.datasetin
azure.signinlogs
35
event.categoryeq
authentication
331
Esql.source_ip_count_distinctge
2
23
Operationeq
AlertEntityGenerated
24
Operationeq
TIMailData
22
RescanVerdictin
Malware
22
RescanVerdictin
Phish
22

Exclusions (112 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
process.code_signature.trustedeq
true
3
Imagewildcard
?:\program files\*.exe
2
process.code_signature.subject_nameeq
Citrix Systems, Inc.
2
process_nameeq
rundll32.exe
2
CommandLinestarts_with
"C:\WINDOWS\system32\mmc.exe" "C:\Windows\System32\gpme.msc" /s /gpobject:"LDAP://
1
DeliveryActioneq
Blocked
1
Imageeq
?:\program files (x86)\microsoft\edge\application\msedge.exe
1
Imageeq
?:\program files\google\chrome\application\chrome.exe
1
Imageeq
?:\program files\internet explorer\iexplore.exe
1
Imageeq
?:\program files\mozilla firefox\firefox.exe
1
Imageeq
?:\windows\system32\mmc.exe
1
Imageeq
?:\windows\system32\vmconnect.exe
1
Imageeq
?:\windows\system32\werfault.exe
1
Imageeq
?:\windows\system32\wermgr.exe
1
Imageeq
c:\windows\system32\conhost.exe
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 3 rules

Elastic 35 rules

Splunk 9 rules

Kusto 6 rules

YARA-L 1 rule

Panther 3 rules