tfMITRE ATT&CK sub-technique

Spearphishing Link T1566.002

Tactic: Initial Access
Platforms: Identity Provider, Linux, macOS, Office Suite, SaaS, Windows
Version: 2.8
Created: 02 March 2020
Last modified: 12 May 2026
Contributors: Philip Winther; Shailesh Tiwary (Indian Army); Mark Wee; Jeff Sakowicz, Microsoft Identity Developer Platform Services (IDPM Services); Saisha Agrawal, Microsoft Threat Intelligent Center (MSTIC); Kobi Haimovich, CardinalOps; Menachem Goldstein

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 2%

Threat groups98th percentile · 98% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 4%

Campaigns96th percentile · 96% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 12%

Tools & malware88th percentile · 88% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 19%

Detection rules81st percentile · 81% of ATT&CK techniques have this many detection rules written or fewer.

Spearphishing Link MITRE reference T1566.002

Top 2%of all ATT&CK techniques for number of groups

46 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

MirrorFaceG1054 ↗

Has embedded OneDrive URLs in emails leading to malicious file installation.1

created 2026-04-171 referenceaka Earth Kasha

Storm-1811G1046 ↗

Has distributed malicious links to victims that redirect to EvilProxy-based phishing sites to harvest credentials.1

created 2025-03-141 reference

APT42G1044 ↗

Has sent spearphishing emails containing malicious links.1 2 3

created 2025-01-083 references

RedCurlG1039 ↗

Has used phishing emails with malicious links to gain initial access.1 2

created 2024-09-232 references

TA577G1037 ↗

Has sent emails containing links to malicious JavaScript files.1

created 2024-09-171 reference

Mustard TempestG1020 ↗

Has sent victims emails containing links to compromised websites.1

created 2023-12-061 referenceaka DEV-0206

All 46 groups for this technique · 6 newest in this preview

Offense vs defense T1566.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 6Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 9

first rule: 2020 Q2 · 6 of 9 campaigns plotted (Operation Dust Storm (dated 2010), Night Dragon (dated 2009) and 1 more fall before the 2017 window)

Spearphishing Link detection strategy DET0107

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Spearphishing Links

Enterprise

4 platforms

AN0298 · Windows

Correlation of inbound emails with embedded links followed by user-driven browser navigation to suspicious or obfuscated domains. Detection chain includes malicious URL in email → user click recorded in Office logs → browser process spawning unusual child processes (e.g., PowerShell, cmd) or download activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Application Log ContentDC0038	m365:unified	Send/Receive: Inbound emails containing embedded or shortened URLs
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SuspiciousTLDs	List of monitored top-level domains commonly abused in phishing (e.g., .xyz, .top, .tk).
URLShortenerDomains	Domains like bit.ly, tinyurl.com flagged for deeper expansion/inspection.
ClickToExecutionWindow	Time threshold between URL click and suspicious process execution.

AN0299 · Linux

Detection of spearphishing links through mail logs and browser activity. Behavior includes email with suspicious URLs → user click recorded in mail/web proxy logs → shell or interpreter launched from browser process.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve: Execution of scripts or binaries spawned from browser processes
Application Log ContentDC0038	Application:Mail	Inbound emails containing hyperlinks from suspicious sources
Network Traffic FlowDC0078	NSM:Flow	Outbound requests to domains not previously resolved or associated with phishing campaigns

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MonitoredBrowsers	List of browser processes to monitor (e.g., firefox, chrome, chromium).
PhishingIndicators	Custom regex patterns for detecting obfuscated or IDN homograph URLs.

AN0300 · macOS

Correlation of Mail.app logs with Safari/Chrome activity. Suspicious behavior includes email links → Safari/Chrome accessing newly registered or lookalike domains → osascript or Terminal spawned unexpectedly.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Browser processes launching unexpected interpreters (osascript, bash)
Application Log ContentDC0038	macos:unifiedlog	Received messages with embedded or shortened URLs
Network Traffic ContentDC0085	macos:unifiedlog	Connections to suspicious domains with mismatched certificate or unusual patterns

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CertificateAnomalies	Flag self-signed or mismatched TLS certificates from spearphishing domains.
ExecutionDelayThreshold	Suspicious delay between URL click and malicious process spawn.

AN0301 · Identity Provider

Detection of OAuth consent phishing or malicious login attempts initiated through spearphishing links. Behavior chain includes inbound email with OAuth URL → consent page visited → unusual token grants logged in IdP logs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	azure:signinlogs	ConsentGrant: Suspicious consent grants to non-approved or unknown applications

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedApps	Whitelisted apps permitted for OAuth consent grants.
AnomalousConsentPatterns	Patterns of consent from unusual geographies, devices, or unapproved applications.

Tests1ExecutorsPowerShell 1Need elevation0 of 1Have prerequisites0Have cleanup0Platformswindows

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Paste and run technique windows PowerShell — — —

Tests the **Paste and Run** technique, where users are tricked into running malicious PowerShell commands by automating the Win+R command to open the Run dialog and input encoded PowerShell to execute calc.exe. - Fake CAPTCHA Campaign - From Clipboard to Compromise

Input arguments

Name	Type	Default	Description
execution_command	String	calc.exe	The command to execute in the run

Attack command

# Add user32.dll for keybd_event
Add-Type @"
    using System;
    using System.Runtime.InteropServices;
    public class K {
        [DllImport("user32.dll")]
        public static extern void keybd_event(byte bVk, byte bScan, uint dwFlags, UIntPtr dwExtraInfo);
    }
"@

# Virtual key codes
$VK_LWIN, $VK_R, $KEYDOWN, $KEYUP = 0x5B, 0x52, 0x0000, 0x0002

# Open Run dialog (Win+R)
[K]::keybd_event($VK_LWIN, 0, $KEYDOWN, [UIntPtr]::Zero)
[K]::keybd_event($VK_R, 0, $KEYDOWN, [UIntPtr]::Zero)
[K]::keybd_event($VK_R, 0, $KEYUP, [UIntPtr]::Zero)
[K]::keybd_event($VK_LWIN, 0, $KEYUP, [UIntPtr]::Zero)

# Short delay for Run dialog
Start-Sleep -Milliseconds 500
Add-Type -AssemblyName System.Windows.Forms
[System.Windows.Forms.SendKeys]::SendWait("cmd /c powershell -ec " + [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes('#{execution_command}')) + "{ENTER}")

GUIDa125d4bf-dd57-486c-969f-0e4388370475

Tests from Atomic Red Team (MIT licence) · technique definition

Spearphishing Link detections T1566.002

13 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 19%of all ATT&CK techniques for number of rules

Product

(none) 1

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs