T1566.002sub-technique of T1566 Phishing
Spearphishing Link
Identity Provider · Linux · macOS · Office Suite · SaaS · Windows7 pieces on this siteT1566.002 on attack.mitre.org
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Business email compromise response plan: the money first, then the mailbox
Two responses that have to run at once. One is a race with a bank transfer measured in hours. The other is evicting an operator who is still reading the mailbox, and who survives a password reset unless you remove what they left behind.
First 15 minutes: a user typed their password into a phishing page
Assume the session was taken, not just the password. Revoke first, find everybody else the email reached, and check what the attacker did with the time they had.
A user reported a phishing email
Somebody forwarded a message to the security mailbox, or clicked the report button.
The evidence it leaves
Where the traces live, and what each source proves and does not.
Chromium browser history
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Guided lab: the mailbox rule that was not the point
A business email compromise where the obvious finding is a decoy. Ninety minutes on Microsoft 365 audit logs, OAuth consent grants, and why resetting the password does not end this incident.
Read
Analyses, case studies, guides, references and interview questions.
Evidence Gap Challenge No. 1: the laptop was reimaged on Tuesday
A supplier is out €96,000 and the only endpoint that mattered was wiped on day one, by a helpdesk following the documented process correctly. Here is every artefact that still exists. Work out what you can prove, what you can only say is consistent, and the one collection change that would have moved the most from the second column to the first.
Incident report: Kesterline Components, 8 May 2026
A full DFIR report on a constructed ransomware incident, written the way one gets handed to a board. Three hours twenty from first execution to encryption, four separate points where it could have been stopped, and the write-up that follows.
how MITRE says to see it
Detection Strategy for Spearphishing Links
- Correlation of inbound emails with embedded links followed by user-driven browser navigation to suspicious or obfuscated domains. Detection chain includes malicious URL in email → user click recorded in Office logs → browser process spawning unusual child processes (e.g., PowerShell, cmd) or download activity.
- Detection of spearphishing links through mail logs and browser activity. Behavior includes email with suspicious URLs → user click recorded in mail/web proxy logs → shell or interpreter launched from browser process.
- Correlation of Mail.app logs with Safari/Chrome activity. Suspicious behavior includes email links → Safari/Chrome accessing newly registered or lookalike domains → osascript or Terminal spawned unexpectedly.
- Detection of OAuth consent phishing or malicious login attempts initiated through spearphishing links. Behavior chain includes inbound email with OAuth URL → consent page visited → unusual token grants logged in IdP logs.
what reduces it
- M1021 Restrict Web-Based Content. Determine if certain websites that can be used for spearphishing are necessary for business operations and consider blocking access if activity cannot be monitored well or if it poses a significant risk.
- M1017 User Training. Users can be trained to identify social engineering techniques and spearphishing emails with malicious links which includes phishing for consent with OAuth 2.0. Additionally, users may perform visual checks of the domains they visit; however, homographs in ASCII and in IDN domains and URL schema obfuscation may render manual checks difficult.
- M1018 User Account Management. Azure AD Administrators apply limitations upon the ability for users to grant consent to unfamiliar or unverified third-party applications.
- M1054 Software Configuration. Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation..
- M1047 Audit. Audit applications and their permissions to ensure access to data and resources are limited based upon necessity and principle of least privilege.