Contagious InterviewG1052 ↗
Has used fake job advertisements and messages sent via social media to spearphish targets.123456 Contagious Interview has also leveraged hiring websites to solicit victims.3
- Tactic
- Initial Access
- Platforms
- Linux, macOS, Windows
- Version
- 2.0
- Created
- 02 March 2020
- Last modified
- 24 October 2025
Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
14
Threat groupsTop 13%
Threat groups87th percentile · 87% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Spearphishing via Service MITRE reference T1566.003
Top 13%of all ATT&CK techniques for number of groups
14 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Storm-1811G1046 ↗
Has used Microsoft Teams to send messages and initiate voice calls to victims posing as IT support personnel.1
Moonstone SleetG1036 ↗
Has used social media services to spear phish victims to deliver trojainized software.1
ToddyCatG1022 ↗
Has sent loaders configured to run Ninja as zip archives via Telegram.1
CURIUMG1012 ↗
Has used social media to deliver malicious files to victims.1
EXOTIC LILYG1011 ↗
Has used the e-mail notification features of legitimate file sharing services for spearphishing.1
All 14 groups for this technique · 6 newest in this preview
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Operation Dream JobC0022 ↗
During Operation Dream Job, Lazarus Group sent victims spearphishing messages via LinkedIn concerning fictitious jobs.12
All 1 campaigns for this technique
Offense vs defense T1566.003
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Spearphishing via Service detection strategy DET0115
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Spearphishing via a Service across OS Platforms
3 platforms
AN0320 · Windows
Inbound spearphishing attempts delivered via third-party services (e.g., Gmail, LinkedIn messages) leading to malicious file downloads or browser-initiated script execution. Defender view includes correlation of external service logins, unexpected file write operations, and suspicious descendant processes spawned from productivity or browser applications.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredServices | List of third-party services (e.g., Gmail, LinkedIn, Dropbox) relevant to the organization’s threat profile. |
| SuspiciousProcessPatterns | Process lineage and parent-child execution relationships considered abnormal (e.g., outlook.exe → powershell.exe). |
| TimeWindow | Correlates file creation and outbound connection activity within a tunable time period after message receipt. |
AN0321 · Linux
Use of non-enterprise email or messaging services in Thunderbird, Evolution, or browsers leading to suspicious file downloads and subsequent execution. Defender view includes browser-initiated downloads of unexpected content and shell or interpreter processes launched post-download.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve: Execution of bash, python, or perl processes spawned by browser/email client |
| Application Log ContentDC0038 | linux:syslog | Inbound messages from webmail services containing attachments or URLs |
| Network Traffic FlowDC0078 | NSM:Flow | Outbound traffic to domains/IPs not previously resolved, occurring shortly after attachment download or link click |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| BrowserProcesses | Configured list of browsers or email clients to monitor (e.g., firefox, chromium, thunderbird). |
| PhishingIndicators | Custom regex rules for suspicious URL patterns, file extensions, or encoded links. |
AN0322 · macOS
Phishing attempts via iCloud Mail, Gmail, or social media apps accessed on macOS systems. Defender view includes Mail.app or Safari downloads of files followed by osascript, Terminal, or abnormal child process execution.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | Execution of osascript, bash, or Terminal initiated from Mail.app or Safari |
| Application Log ContentDC0038 | macos:unifiedlog | Received messages containing embedded links or attachments from non-enterprise services |
| Network Traffic ContentDC0085 | macos:unifiedlog | Suspicious outbound HTTPS requests to domains flagged as newly registered or untrusted after spearphishing message interaction |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CertificateChecks | Flagging mismatched or self-signed certificates during outbound connections initiated after spearphishing messages. |
| ExecutionDelay | Window of time between attachment download and subsequent suspicious execution. |
Anti-virus can also automatically quarantine suspicious files.
AuditM1047
Implement auditing and logging for interactions with third-party messaging services or collaboration platforms. Monitor user activity and review logs for signs of suspicious links, downloads, or file exchanges that could indicate spearphishing attempts. Effective auditing allows for the quick identification of malicious activity originating from compromised service accounts.
Determine if certain social media sites, personal webmail services, or other service that can be used for spearphishing is necessary for business operations and consider blocking access if activity cannot be monitored well or if it poses a significant risk.
Enforce strict user account management policies on third-party service accounts to control access and limit privileges. Configure accounts with the minimum permissions necessary to perform their roles and regularly review access levels. This minimizes the risk of adversaries exploiting service accounts to execute spearphishing attacks or gain unauthorized access to sensitive resources.
User TrainingM1017
Users can be trained to identify social engineering techniques and spearphishing messages with malicious links.