T1566
Phishing
Identity Provider · Linux · macOS · Office Suite · SaaS · Windows8 pieces on this siteT1566 on attack.mitre.org
Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Business email compromise response plan: the money first, then the mailbox
Two responses that have to run at once. One is a race with a bank transfer measured in hours. The other is evicting an operator who is still reading the mailbox, and who survives a password reset unless you remove what they left behind.
First 15 minutes: a user typed their password into a phishing page
Assume the session was taken, not just the password. Revoke first, find everybody else the email reached, and check what the attacker did with the time they had.
A user reported a phishing email
Somebody forwarded a message to the security mailbox, or clicked the report button.
The evidence it leaves
Where the traces live, and what each source proves and does not.
Chromium browser history
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Guided lab: nine hours at Northwind Freight, from lure to scheduled task
A constructed intrusion written as a DFIR report. You get the same artifacts an analyst gets on day one, in the order they arrive, and you build the timeline yourself. The company is fictional; the techniques, event IDs and analytic reasoning are not.
Guided lab: the mailbox rule that was not the point
A business email compromise where the obvious finding is a decoy. Ninety minutes on Microsoft 365 audit logs, OAuth consent grants, and why resetting the password does not end this incident.
Read
Analyses, case studies, guides, references and interview questions.
Evidence Gap Challenge No. 1: the laptop was reimaged on Tuesday
A supplier is out €96,000 and the only endpoint that mattered was wiped on day one, by a helpdesk following the documented process correctly. Here is every artefact that still exists. Work out what you can prove, what you can only say is consistent, and the one collection change that would have moved the most from the second column to the first.
Incident report: Kesterline Components, 8 May 2026
A full DFIR report on a constructed ransomware incident, written the way one gets handed to a board. Three hours twenty from first execution to encryption, four separate points where it could have been stopped, and the write-up that follows.
how MITRE says to see it
Detection Strategy for Phishing across platforms.
- Unusual inbound email activity where attachments or embedded URLs are delivered to users followed by execution of new processes or suspicious document behavior. Detection involves correlating email metadata, file creation, and network activity after a phishing message is received.
- Monitor for malicious payload delivery through phishing where attachments or URLs in email clients (e.g., Thunderbird, mutt) result in unusual file creation or outbound network connections. Focus on correlation between mail logs, file writes, and execution activity.
- Detection of phishing through anomalous Mail app activity, such as attachments saved to disk and immediately executed, or Safari/Preview launching URLs and files linked from email messages. Correlate UnifiedLogs events with subsequent process execution.
- Phishing via Office documents containing embedded macros or links that spawn processes. Detection relies on correlating Office application logs with suspicious child process execution and outbound network connections.
what reduces it
- M1031 Network Intrusion Prevention. Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity.
- M1021 Restrict Web-Based Content. Determine if certain websites or attachment types (ex:.scr,.exe,.pif,.cpl, etc.) that can be used for phishing are necessary for business operations and consider blocking access if activity cannot be monitored well or if it poses a significant risk.
- M1017 User Training. Users can be trained to identify social engineering techniques and phishing emails.
- M1049 Antivirus/Antimalware. Anti-virus can automatically quarantine suspicious files.
- M1054 Software Configuration. Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.
- M1047 Audit. Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.