MirrorFaceG1054 ↗
Has sent spearphishing emails with malicious attachments to deliver malware payloads.123
- Tactic
- Initial Access
- Platforms
- Linux, macOS, Windows
- Version
- 2.2
- Created
- 02 March 2020
- Last modified
- 12 May 2026
- Contributor
- Philip Winther
Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution.[1] Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
78
Threat groupsTop 1%
Threat groups99th percentile · 99% of ATT&CK techniques have this many threat groups attributed or fewer.10
CampaignsTop 3%
Campaigns97th percentile · 97% of ATT&CK techniques have this many campaigns recorded or fewer.61
Tools & malwareTop 6%
Tools & malware94th percentile · 94% of ATT&CK techniques have this many tools implementing them or fewer.56
Detection rulesTop 3%
Detection rules97th percentile · 97% of ATT&CK techniques have this many detection rules written or fewer.Spearphishing Attachment MITRE reference T1566.001
Top 1%of all ATT&CK techniques for number of groups
78 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
RedCurlG1039 ↗
Has used phishing emails with malicious files to gain initial access.12
Moonstone SleetG1036 ↗
Delivered various payloads to victims as spearphishing attachments.1
Winter VivernG1035 ↗
Leverages malicious attachments delivered via email for initial access activity.123
Star BlizzardG1033 ↗
Has sent emails with malicious .pdf files to spread malware.1
Saint BearG1031 ↗
Uses a variety of file formats, such as Microsoft Office documents, ZIP archives, PDF documents, and other items as phishing attachments for initial access.1
All 78 groups for this technique · 6 newest in this preview
10 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
RedDelta Modified PlugX Infection Chain OperationsC0047 ↗
Mustang Panda leveraged malicious attachments in spearphishing emails for initial access to victim environments in RedDelta Modified PlugX Infection Chain Operations.1
Water Curupira Pikabot DistributionC0037 ↗
Attached password-protected ZIP archives to deliver Pikabot installers.1
C0011C0011 ↗
During C0011, Transparent Tribe sent malicious attachments via email to student targets in India.1
C0015C0015 ↗
For C0015, security researchers assessed the threat actors likely used a phishing campaign to distribute a weaponized attachment to victims.1
Operation SpalaxC0005 ↗
During Operation Spalax, the threat actors sent phishing emails that included a PDF document that in some cases led to the download and execution of malware.1
Operation Dream JobC0022 ↗
During Operation Dream Job, Lazarus Group sent emails with malicious attachments to gain unauthorized access to targets' computers.12
All 10 campaigns for this technique · 6 newest in this preview
61 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Kali365S9044 ↗
Has delivered phishing emails with malicious PDF, Word, Excel, and PowerPoint attachments that direct victims to actor-controlled landing pages. 1
RustyWaterS9037 ↗
Has sent spearphishing emails with the attachment Cybersecurity.doc, which served as the primary payload for the next stage.1
LAMEHUGS9035 ↗
Has been distributed through spearphishing emails with various AI-themed malicious attachments.1
LODEINFOS9020 ↗
Has been distributed to targeted victims via malicious email attachments.123
QilinS1242 ↗
Has been delivered to victims through malicious email attachments.1
Lumma StealerS1213 ↗
Has been delivered through phishing emails with malicious attachments.1
All 61 software entries for this technique · 6 newest in this preview
Offense vs defense T1566.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 9Sigma rules (cumulative) · 24Splunk ESCU (cumulative) · 32
first rule: 2017 Q3 · 9 of 10 campaigns plotted (Operation AkaiRyū (dated 2004) falls before the 2014 window)Spearphishing Attachment detection strategy DET0236
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Spearphishing Attachment across OS Platforms
3 platforms
AN0655 · Windows
Detection of spearphishing attachments by correlating suspicious email delivery with subsequent file creation and abnormal process execution (e.g., Office spawning PowerShell or CMD). Behavior chain includes inbound email metadata → attachment stored on disk → process execution → outbound network activity.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Application Log ContentDC0038 | m365:unified | Send/Receive: Inbound emails with attachments from suspicious or spoofed senders |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AttachmentExtensions | List of high-risk extensions to monitor (e.g., .exe, .js, .vbs, .docm, .xlsm). |
| SuspiciousParentChildPairs | Process lineage patterns considered malicious (e.g., winword.exe → powershell.exe). |
| TimeWindow | Correlation window between email receipt, file creation, and process execution. |
AN0656 · Linux
Phishing attachments executed on Linux systems are detected by linking email logs to file creation in mail directories and subsequent suspicious process execution. Look for unexpected binaries or scripts spawned from user mail directories and anomalous outbound network activity.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve: Execution of files saved in mail or download directories |
| Application Log ContentDC0038 | Application:Mail | Inbound email attachments logged from MTAs with suspicious metadata |
| Network Traffic FlowDC0078 | NSM:Flow | Outbound traffic from suspicious new processes post-attachment execution |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AttachmentStoragePaths | Monitored directories for email attachments (e.g., /var/mail, ~/Maildir, ~/Downloads). |
| ScriptInterpreters | List of interpreters to monitor when spawned by mail clients (e.g., bash, python, perl). |
AN0657 · macOS
Phishing attachment detection on macOS through correlation of Mail app logs, file creation in user directories, and abnormal process execution (e.g., Preview.app or Mail.app spawning Terminal or scripting binaries). Network traffic after attachment interaction is also monitored.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | Execution of Terminal, osascript, or other interpreters originating from Mail or Preview |
| Application Log ContentDC0038 | macos:unifiedlog | Inbound messages with attachments from suspicious domains |
| File CreationDC0039 | macos:unifiedlog | Attachment files written to ~/Downloads or temporary folders |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ExecutionDelayThreshold | Time delay between attachment download and execution considered suspicious. |
| SuspiciousParentApps | Parent processes expected to rarely spawn child processes (e.g., Mail.app, Preview.app). |
Anti-virus can also automatically quarantine suspicious files.
AuditM1047
Enable auditing and monitoring for email attachments and file transfers to detect and investigate suspicious activity. Regularly review logs for anomalies related to attachments containing potentially malicious content, as well as any attempts to execute or interact with these files. This practice helps identify spearphishing attempts before they can lead to further compromise.
Network intrusion prevention systems and systems designed to scan and remove malicious email attachments can be used to block activity.
Block unknown or unused attachments by default that should not be transmitted over email as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl, etc. Some email scanning devices can open and analyze compressed and encrypted formats, such as zip and rar that may be used to conceal malicious attachments.
Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.
Apply user account management principles to limit permissions for accounts interacting with email attachments, ensuring that only necessary accounts have the ability to open or execute files. Restricting account privileges reduces the potential impact of malicious attachments by preventing unauthorized execution or spread of malware within the environment.
User TrainingM1017
Users can be trained to identify social engineering techniques and spearphishing emails.
Tests2ExecutorsPowerShell 2Need elevation0 of 2Have prerequisites1Have cleanup2Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition