Phishing for Information T1598

Tactic: Reconnaissance

Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code.

Events covered

2 catalog events are tagged with this technique by at least one rule.

Authoring guide

These 9 rules share fields, values, and exclusions.

Fields filtered most (14 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
CommandLine2contains 2, in 1*\\appdata\\local\\microsoft\\outlook\\*, *\\appdata\\local\\temp\\*, *\\content.outlook\\*, .htm, :\users\
ChannelCount1gt 13
Event1eq 1chat_message.sent
EventType1eq 1intrusionevent
Image1ends_with 1\brave.exe, \chrome.exe, \firefox.exe
Message1regex_match 1http(s?):\/\/
TriggerCount1eq 11
id.applicationName1eq 1gmail
parameters.message_info.is_spam1eq 1true
phishScore1ge 190
quarantineFolder1eq 1Phish
quarantineRule1eq 1phish
sourcetype1eq 1cisco:sfw:estreamer
threatsInfoMap1array_any 1

Top indicator values (26 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
ChannelCountgt
3
1
CommandLinecontains
.htm
1
CommandLinecontains
.rdp
1
CommandLinecontains
:\users\
16
CommandLinecontains
\downloads\
115
CommandLinein
*\\appdata\\local\\microsoft\\outlook\\*
1
CommandLinein
*\\appdata\\local\\temp\\*
12
CommandLinein
*\\content.outlook\\*
1
CommandLinein
*\\downloads\\*
1
CommandLinein
*\\olk\\attachments\\*
1
Eventeq
chat_message.sent
1
EventTypeeq
intrusionevent
118
Imageends_with
\brave.exe
111
Imageends_with
\chrome.exe
113
Imageends_with
\firefox.exe
16
Imageends_with
\msedge.exe
114
Imageends_with
\opera.exe
111
Imageends_with
\vivaldi.exe
111
Messageregex_match
http(s?):\/\/
1
TriggerCounteq
1
1
id.applicationNameeq
gmail
17
parameters.message_info.is_spameq
true
13
phishScorege
90
1
quarantineFoldereq
Phish
1
quarantineRuleeq
phish
1
sourcetypeeq
cisco:sfw:estreamer
132

Exclusions (1 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
actor.emailcontains
/hd/domain/
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 1 rule

Splunk 2 rules

Kusto 3 rules

Panther 3 rules