Phishing T1566

Tactic: Initial Access

Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.

Events covered

28 catalog events are tagged with this technique by at least one rule.

ProviderEventTitle
SysmonEvent ID 1Process creation
SysmonEvent ID 3Network connection
SysmonEvent ID 7Image loaded
SysmonEvent ID 11FileCreate
SysmonEvent ID 12RegistryEvent (Object create and delete)
SysmonEvent ID 13RegistryEvent (Value Set)
SysmonEvent ID 14RegistryEvent (Key and Value Rename)
SysmonEvent ID 22DNSEvent (DNS query)
Security-AuditingEvent ID 4656A handle to an object was requested.
Security-AuditingEvent ID 4663An attempt was made to access an object.
Security-AuditingEvent ID 4688A new process has been created.
Security-AuditingEvent ID 5379Credential Manager credentials were read.
Defender-DeviceEventsanyDefender event (any)
Defender-DeviceFileEventsFileCreatedFile created
Defender-DeviceFileEventsFileRenamedFile renamed
Defender-DeviceProcessEventsanyProcess activity (any)
Defender-DeviceProcessEventsProcessCreatedProcess created
ESFexecProcess Execution (Notify)
Windows-DefenderEvent ID 1121Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator.
Windows-DefenderEvent ID 1122Microsoft Defender Exploit Guard audited an operation that is not allowed by your IT administrator.
Windows-DefenderEvent ID 1125Your IT administrator would have caused Microsoft Defender Exploit Guard to block a potentially dangerous network connection.
Windows-DefenderEvent ID 1126Your IT administrator has caused Microsoft Defender Exploit Guard to block a potentially dangerous network connection.
Windows-DefenderEvent ID 1129A user has allowed a blocked Microsoft Defender Exploit Guard operation.
Windows-DefenderEvent ID 1131ProductName has blocked an operation that your administrator doesn't allow.
Windows-DefenderEvent ID 1132ProductName has audited an operation.
Windows-DefenderEvent ID 1133ProductName has blocked an operation that your administrator doesn't allow.
Windows-DefenderEvent ID 1134ProductName has audited an operation.
Windows-DefenderEvent ID 5007Product Name Configuration has changed.

Authoring guide

Patterns shared across the 260 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (324 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
EventType29eq 25, contains 3, in 1, starts_with 1Sign-in activity, UserLoggedIn, start, analyzer, authorize
process_name29eq 21, in 8, wildcard 1excel.exe, eqnedt32.exe, graph.exe, arp.exe, atbroker.exe
parent_process_name25eq 14, in 9, match 2excel.exe, EQNEDT32.exe, Graph.exe, explorer.exe, powerpnt.exe
Image24ends_with 14, contains 4, wildcard 4, is_not_null 3, in 1, starts_with 1\brave.exe, \certutil.exe, \chrome.exe, \cmd.exe, \cscript.exe
data_stream.dataset24eq 21, in 3azure.signinlogs, o365.audit, azure.activitylogs, google_workspace.token, azure.auditlogs
sourcetype24eq 24zscalernss-web, o365:management:activity, gsuite:gmail:bigquery, gws:reports:drive, azure:monitor:aad
EventID19eq 13, in 61, 7, 1121, 1122, 1125
event.type19eq 19, ne 1start, creation, deletion
TargetFilename16contains 9, ends_with 9, match 3, in 2, wildcard 1.docm, .dotm, .iso, .potm, (?i)((\x5cappdata\x5clocal\x5cmicrosoft\x5cwindows\x5c.*\...
Active12eq 12true
Channel12eq 12
ParentImage12ends_with 9, eq 2, in 1\winword.exe, /script editor, ?:\windows\system32\mmc.exe, \7zfm.exe, \cscript.exe
event.outcome12eq 10, in 2success, Success, failure, unknown
CommandLine11contains 7, match 2, ends_with 1, in 1, ne 1(?i)((\x5cAppData\x5cLocal\x5cMicrosoft\x5cWindows\x5c.*\..., .exe, *.dll*, *http:*, *https:*
NetworkDirection11eq 11Incoming, inbound

Top indicator values (1537 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
event.typeeq
start
15606
Activeeq
true
1268
sourcetypeeq
zscalernss-web
1212
data_stream.dataseteq
azure.signinlogs
1030
data_stream.dataseteq
o365.audit
745
NetworkDirectioneq
Incoming
99
actioneq
blocked
910
event.outcomeeq
success
9251
IndicatorTypeeq
email-addr
88
id.applicationNameeq
gmail
77
process_nameeq
mshta.exe
731
process_nameeq
powershell.exe
7104
process_nameeq
cscript.exe
625
process_nameeq
wscript.exe
629
process_nameeq
cmd.exe
577
event.categoryeq
authentication
631
parent_process_namein
excel.exe
612
parent_process_namein
onenote.exe
67
parent_process_namein
onenotem.exe
66
parent_process_namein
powerpnt.exe
611
parent_process_namein
winword.exe
612
parent_process_namein
EQNEDT32.exe
55
parent_process_namein
Graph.exe
55
parent_process_namein
msaccess.exe
55
parent_process_namein
mspub.exe
55
parent_process_namein
onenoteim.exe
55
parent_process_namein
outlook.exe
57
parent_process_namein
visio.exe
55
parent_process_namein
winproj.exe
55
EventTypeeq
Sign-in activity
56

Exclusions (258 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
DeliveryActioncontains
blocked
6
Descriptioncontains
State: falsepos;
6
Descriptioncontains
State: inactive;
6
process.code_signature.trustedeq
true
4
Imagewildcard
?:\program files\*.exe
3
Imagewildcard
?:\program files (x86)\*.exe
2
Imagewildcard
?:\windows\system32\notepad.exe
2
process_nameeq
rundll32.exe
3
source_domaineq
internal_test_email.com
3
FilterDispositionin
discard
2
FilterDispositionin
reject
2
dest_ipcidr_match
10.0.0.0/8
2
dest_ipcidr_match
127.0.0.0/8
2
dest_ipcidr_match
169.254.0.0/16
2
dest_ipcidr_match
172.16.0.0/12
2

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 35 rules

Elastic 55 rules

Splunk 56 rules

Kusto 86 rules

YARA-L 4 rules

Panther 24 rules