tfMITRE ATT&CK technique

Phishing T1566

Tactic: Initial Access
Platforms: Identity Provider, Linux, macOS, Office Suite, SaaS, Windows
Version: 2.7
Created: 02 March 2020
Last modified: 12 May 2026
Contributors: Philip Winther; Ohad Zaidenberg, @ohad_mz; Liora Itkin; Liran Ravich, CardinalOps; Scott Cook, Capital One

Sub-techniques 486 rules across the family · 31 mapped directly to T1566 · 2 of 4 carry rules

.001Spearphishing Attachment56 .002Spearphishing Link13 .003Spearphishing via Service0 .004Spearphishing Voice0

Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 21%

Threat groups79th percentile · 79% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware57th pct

Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 8%

Detection rules92nd percentile · 92% of ATT&CK techniques have this many detection rules written or fewer.

Phishing MITRE reference T1566

Top 21%of all ATT&CK techniques for number of groups

8 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

VOID MANTICOREG1055 ↗

Has emailed victims threatening messages.1 VOID MANTICORE has used phishing as an initial access vector.2

created 2026-04-202 referencesaka COBALT MYSTIQUE

AppleJeusG1049 ↗

Has used spearphishing emails to distribute malicious payloads.1

created 2025-08-251 referenceaka Gleaming Pisces

Sea TurtleG1041 ↗

Used spear phishing to gain initial access to victims.1

created 2024-11-201 referenceaka Teal Kurma

INC RansomG1032 ↗

Has used phishing to gain initial access.1 2

created 2024-06-062 referencesaka GOLD IONIC

GOLD SOUTHFIELDG0115 ↗

Has conducted malicious spam (malspam) campaigns to gain access to victim's machines.1

created 2020-09-221 referenceaka Pinchy Spider

KimsukyG0094 ↗

Has used spearphishing to gain initial access and intelligence.1 2

created 2019-08-262 referencesaka Black Banshee

All 8 groups for this technique · 6 newest in this preview

Offense vs defense T1566

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 14Splunk ESCU (cumulative) · 17

first rule: 2017 Q1

Phishing detection strategy DET0070

MITRE names one behaviour worth catching for this technique and breaks it into 6 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Phishing across platforms.

Enterprise

6 platforms

AN0188 · Windows

Unusual inbound email activity where attachments or embedded URLs are delivered to users followed by execution of new processes or suspicious document behavior. Detection involves correlating email metadata, file creation, and network activity after a phishing message is received.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Application Log ContentDC0038	m365:unified	Send/Receive: Emails with suspicious sender domains, spoofed headers, or anomalous attachment types
File CreationDC0039	WinEventLog:Sysmon	EventCode=11

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SuspiciousFileTypes	Attachment types considered high risk (e.g., .exe, .js, .vbs, .scr, macro-enabled docs).
AllowedSenders	Whitelist of known trusted senders to reduce false positives.

AN0189 · Linux

Monitor for malicious payload delivery through phishing where attachments or URLs in email clients (e.g., Thunderbird, mutt) result in unusual file creation or outbound network connections. Focus on correlation between mail logs, file writes, and execution activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve: Execution of scripts or binaries sourced from mail directories (/var/mail, ~/Maildir)
Application Log ContentDC0038	Application:Mail	Inbound messages with anomalous headers, spoofed SPF/DKIM failures

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MonitoredMailPaths	System or user directories where emails/attachments are stored.
AttachmentHashBaseline	Known good hashes for common business document templates.

AN0190 · macOS

Detection of phishing through anomalous Mail app activity, such as attachments saved to disk and immediately executed, or Safari/Preview launching URLs and files linked from email messages. Correlate UnifiedLogs events with subsequent process execution.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Preview.app, Safari.app, or Mail.app spawning new processes outside normal patterns
Application Log ContentDC0038	macos:unifiedlog	Inbound email activity with suspicious domains or mismatched sender information

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SuspiciousDomains	List of domains known for phishing activity or suspicious sender infrastructure.
ExecutionDelayWindow	Time threshold between file save and execution considered suspicious.

AN0191 · Office Suite

Phishing via Office documents containing embedded macros or links that spawn processes. Detection relies on correlating Office application logs with suspicious child process execution and outbound network connections.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Application Log ContentDC0038	m365:unified	FileAccessed: Access of email attachments by Office applications

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentProcessList	Parent processes expected to execute child processes (e.g., Office apps).
MacroExecutionThreshold	Threshold for number of macros executed before raising alerts.

AN0192 · Identity Provider

Phishing attempts targeting IdPs often manifest as anomalous login attempts from suspicious email invitations or fake SSO prompts. Detection correlates login flows, MFA bypass attempts, and anomalous geographic patterns following phishing email delivery.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Logon Session CreationDC0067	azure:signinlogs	Failed MFA attempts, unusual conditional access triggers, login attempts from unexpected IP ranges

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
GeoAnomalyThreshold	Allowed distance/time delta between user sign-ins.
MFABypassIndicators	Signals of repeated or anomalous MFA failures linked to phishing campaigns.

AN0193 · SaaS

Phishing delivered via SaaS services (chat, collaboration platforms) where messages contain malicious URLs or attachments. Detect anomalous link clicks, suspicious file uploads, or token misuse after SaaS-based phishing attempts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	saas:collaboration	MessagePosted: Suspicious links or attachment delivery via collaboration tools (Slack, Teams, Zoom)

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MonitoredSaaSApps	Scope of SaaS platforms under phishing monitoring.
LinkInspectionPolicy	Threshold for auto-expansion and detonation of URLs sent in SaaS messages.

Phishing detections T1566

31 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 8%of all ATT&CK techniques for number of rules

Product

(none) 3

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs