tfMITRE ATT&CK technique

Internal Spearphishing T1534

Tactic: Lateral Movement
Platforms: Linux, macOS, Office Suite, SaaS, Windows
Version: 1.4
Created: 04 September 2019
Last modified: 12 May 2026
Contributors: Tim MalcomVetter; Swetha Prabakaran, Microsoft Threat Intelligence Center (MSTIC)

After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is initially compromised either by controlling the user's device or by compromising the account credentials of the user. Adversaries may then attempt to take advantage of the trusted internal account to increase the likelihood of tricking more victims into falling for phish attempts, often incorporating Impersonation.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 25%

Threat groups75th percentile · 75% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Internal Spearphishing MITRE reference T1534

Top 25%of all ATT&CK techniques for number of groups

6 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

APT-C-36G0099 ↗

Has used a compromised account to send a phishing email to an address likely used and monitored by the IT team within the same targeted organization.1

created 2020-05-051 referenceaka Blind Eagle

KimsukyG0094 ↗

Has sent internal spearphishing emails for lateral movement after stealing victim information.1

created 2019-08-261 referenceaka Black Banshee

HEXANEG1001 ↗

Has conducted internal spearphishing attacks against executives, HR, and IT personnel to gain information and access.1

created 2018-10-171 referenceaka Lyceum

LeviathanG0065 ↗

Has conducted internal spearphishing within the victim's environment for lateral movement.1

created 2018-04-181 referenceaka MUDCARP

MuddyWaterG0069 ↗

Has used compromised mailboxes within target organizations to send spearphishing emails.1

created 2018-04-181 referenceaka Earth Vetala

Gamaredon GroupG0047 ↗

Has used an Outlook VBA module on infected systems to send phishing emails with malicious attachments to other employees within the organization.1

created 2017-05-311 referenceaka IRON TILDEN

All 6 groups for this technique

Offense vs defense T1534

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Internal Spearphishing detection strategy DET0054

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Internal Spearphishing via Trusted Accounts

Enterprise

5 platforms

AN0147 · Windows

Sequence of internal email sent from a recently compromised user account (preceded by abnormal logon or device activity), with attachments or links leading to execution or credential harvesting. Defender observes: internal mail delivery to peers with high entropy attachments, followed by click events, process initiation, or credential prompts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	WinEventLog:Security	EventCode=4625
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Application Log ContentDC0038	m365:unified	SendOnBehalf, MessageSend, ClickThrough, MailItemsAccessed
Logon Session CreationDC0067	WinEventLog:Security	EventCode=4624, 4648
Logon Session MetadataDC0088	WinEventLog:Security	EventCode=4672

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Expected time between internal email and link execution or file dropper
UserContext	Baseline logon locations and device usage for sender accounts
AttachmentEntropyThreshold	Entropy value over which attachment is considered suspicious

AN0148 · Linux

Delivery of suspicious internal communication (e.g., Thunderbird, Evolution) using compromised internal accounts. Sequence of: unexpected user activity + mail transfer logs + download or execution of attachments.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Application Log ContentDC0038	Application:Mail	smtpd$.$: .from=[.@internaldomain.com](mailto:.@internaldomain.com) to=[.@internaldomain.com](mailto:.@internaldomain.com)
Network Traffic ContentDC0085	linux:syslog	curl\|wget\|python .*http

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SubjectLineAnomaly	Deviation from typical internal email subjects
AttachmentType	Executable types allowed or flagged by mail relay

AN0149 · macOS

Abnormal Apple Mail use, including internal email relays followed by file execution or script events (e.g., attachments launched via Preview, terminal triggered from Mail.app)

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	com.apple.mail.* exec.*
Network Traffic ContentDC0085	macos:unifiedlog	curl\|osascript.*open location

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExecutionChainDepth	Number of child processes stemming from Mail.app
MailScriptFlag	Toggle on scripting detection within mail context

AN0150 · SaaS

Internal spearphishing via SaaS applications (e.g., Slack, Teams, Gmail): message sent from compromised user with attachment or URL, followed by click and credential access behavior.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	saas:slack	file_upload, message_send, message_click

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserAnomalyThreshold	Volume or timing of messages sent after compromise
FileRiskScoring	Whether SaaS DLP assigns risk scores to attachments

AN0151 · Office Suite

Outlook or Word used to forward suspicious internal attachments with macro content. Defender observes attachment forwarding, auto-opening behaviors, or macro prompt interactions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	m365:unified	SendOnBehalf, MessageSend, AttachmentPreviewed
Command ExecutionDC0064	WinEventLog:Security	EventCode=4103, 4104, 4105, 4106

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MacroExecutionWindow	Timing between mail open and macro invocation
AttachmentNameHeuristics	Patterns of known internal spearphishing lures (e.g., invoice, HR_policy)

Internal Spearphishing detections T1534

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs