T1566.002 Spearphishing Link

initial access — Identity Provider, Linux, macOS, Office Suite, SaaS, Windows · attack.mitre.org · JSON

MITRE detection strategy

analytics

Sigma rules tagged attack.t1566.002

KEV CVEs mapped here

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging User Execution. The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place.Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an "IDN homograph attack"). URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, hxxp://google.com@1157586937.Adversaries may also utilize links to perform consent phishing/spearphishing campaigns to Steal Application Access Tokens that grant immediate access to the victim environment. For example, a user may be lured into granting adversaries permissions/access via a malicious OAuth 2.0 request URL that when accepted by the user provide permissions/access for malicious applications. These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls.Similarly, malicious links may also target device-based authorization, such as OAuth 2.0 device authorization grant flow which is typically used to authenticate devices without UIs/browsers. Known as “device code phishing,” an adversary may send a link that directs the victim to a malicious authorization page where the user is tricked into entering a code/credentials that produces a device token.

KEV CVEs mapped to this technique · CTID Mappings Explorer

CVE	Vendor / product	Mapping type	State	Added
CVE-2023-2533	PaperCut NG/MF	exploitation technique	Mapped	2025-07-28
CVE-2024-42009	Roundcube Webmail	exploitation technique	Mapped	2025-06-09
CVE-2024-27443	Synacor Zimbra Collaboration Suite (ZCS)	exploitation technique	Mapped	2025-05-19
CVE-2024-21413	Microsoft Office Outlook	exploitation technique	Mapped	2025-02-06
CVE-2015-5119	Adobe Flash Player	exploitation technique	Mapped	2022-03-03

Detection strategy · ATT&CK Enterprise v19.2

DET0107 Detection Strategy for Spearphishing Links v1.0
AN0298 Windows
Correlation of inbound emails with embedded links followed by user-driven browser navigation to suspicious or obfuscated domains. Detection chain includes malicious URL in email → user click recorded in Office logs → browser process spawning unusual child processes (e.g., PowerShell, cmd) or download activity.

m365:unified Send/Receive: Inbound emails containing embedded or shortened URLs → DC0038 Application Log Content
WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: SuspiciousTLDs URLShortenerDomains ClickToExecutionWindow

AN0299 Linux
Detection of spearphishing links through mail logs and browser activity. Behavior includes email with suspicious URLs → user click recorded in mail/web proxy logs → shell or interpreter launched from browser process.

Application:Mail Inbound emails containing hyperlinks from suspicious sources → DC0038 Application Log Content
auditd:SYSCALL execve: Execution of scripts or binaries spawned from browser processes → DC0032 Process Creation
NSM:Flow Outbound requests to domains not previously resolved or associated with phishing campaigns → DC0078 Network Traffic Flow

Tunable: MonitoredBrowsers PhishingIndicators

AN0300 macOS
Correlation of Mail.app logs with Safari/Chrome activity. Suspicious behavior includes email links → Safari/Chrome accessing newly registered or lookalike domains → osascript or Terminal spawned unexpectedly.

macos:unifiedlog Received messages with embedded or shortened URLs → DC0038 Application Log Content
macos:unifiedlog Browser processes launching unexpected interpreters (osascript, bash) → DC0032 Process Creation
macos:unifiedlog Connections to suspicious domains with mismatched certificate or unusual patterns → DC0085 Network Traffic Content

Tunable: CertificateAnomalies ExecutionDelayThreshold

AN0301 Identity Provider
Detection of OAuth consent phishing or malicious login attempts initiated through spearphishing links. Behavior chain includes inbound email with OAuth URL → consent page visited → unusual token grants logged in IdP logs.

azure:signinlogs ConsentGrant: Suspicious consent grants to non-approved or unknown applications → DC0038 Application Log Content

Tunable: AllowedApps AnomalousConsentPatterns

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1566.002`

Suspicious Email Delivered In Microsoft 365 mediumexperimental

Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) · 2026-01-27 · logsource: product=m365 service=audit · 3569aefd-e535-4391-8c18-24bd01a21eaf

Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (formerly ATP) engine, was delivered to a user's Inbox or Junk folder. It might indicate that a potential threat, such as a spearphishing attachment or links, has bypassed initial blocking mechanisms and reached an end-user, requiring further investigation and potential remediation.

Techniques: T1566.001 T1566.002

Potential Malicious Usage of CloudTrail System Manager hightest

Author: jamesc-grafana · 2024-07-11 (modified 2025-12-08) · logsource: product=aws service=cloudtrail · 38e7f511-3f74-41d4-836e-f57dfa18eead

Detect when System Manager successfully executes commands against an instance.

Techniques: T1566 T1566.002

Suspicious Execution via macOS Script Editor mediumtest

Author: Tim Rauch (rule), Elastic (idea) · 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4

Detects when the macOS Script Editor utility spawns an unusual child process.

Techniques: T1566 T1566.002 T1059 T1059.002 T1204 T1204.001 T1553

EvilTokens PhaaS Kit Phishing Related Request - Proxy lowexperimental

Author: uniqu3-us3r · 2026-04-28 · logsource: category=proxy · e0e121d0-be4d-4281-af7e-17abbba4a408

Detects outbound web proxy requests to URLs matching the EvilTokens Phishing-as-a-Service (PhaaS) kit infrastructure. Specifically Cloudflare Workers and Railway.app domains used in OAuth device code authorization phishing attacks. This indicates a user has clicked a phishing link.

Techniques: T1566.002

Rules tagged at the parent level (attack.t1566) 14

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Download From Suspicious TLD - Blacklist lowtest

Author: Florian Roth (Nextron Systems) · 2017-11-07 (modified 2023-05-18) · logsource: category=proxy · 00d0b5ab-1f55-4120-8e83-487c0a7baf19

Detects download of certain file types from hosts in suspicious TLDs

Techniques: T1566 T1203 T1204.002

Suspicious External WebDAV Execution hightest

Author: Ahmed Farouk · 2024-05-10 · logsource: category=proxy · 1ae64f96-72b6-48b3-ad3d-e71dff6c6398

Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.

Techniques: T1584 T1566

CVE-2021-31979 CVE-2021-33771 Exploits criticaltest

Author: Sittikorn S, frack113 · 2021-07-16 (modified 2023-08-17) · logsource: product=windows category=registry_set · 32b5db62-cb5f-4266-9639-0fa48376ac00

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Techniques: T1566 T1203

CVE tags: CVE-2021-33771CVE-2021-31979

Potential Malicious Usage of CloudTrail System Manager hightest

Author: jamesc-grafana · 2024-07-11 (modified 2025-12-08) · logsource: product=aws service=cloudtrail · 38e7f511-3f74-41d4-836e-f57dfa18eead

Detect when System Manager successfully executes commands against an instance.

Techniques: T1566 T1566.002

WebDAV Temporary Local File Creation mediumtest

Author: Micah Babinski · 2023-08-21 · logsource: product=windows category=file_event · 4c55738d-72d8-490e-a2db-7969654e375f

Detects the creation of WebDAV temporary files with potentially suspicious extensions

Techniques: T1584 T1566

HTML Help HH.EXE Suspicious Child Process hightest

Author: Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems) · 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · 52cad028-0ff0-4854-8f67-d25dfcbc78b4

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Techniques: T1047 T1059.001 T1059.003 T1059.005 T1059.007 T1218 T1218.001 T1218.010 T1218.011 T1566 T1566.001

Suspicious Execution via macOS Script Editor mediumtest

Author: Tim Rauch (rule), Elastic (idea) · 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4

Detects when the macOS Script Editor utility spawns an unusual child process.

Techniques: T1566 T1566.002 T1059 T1059.002 T1204 T1204.001 T1553

CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum criticaltest

Author: Sittikorn S · 2021-07-16 (modified 2022-10-09) · logsource: product=windows category=file_event · ad7085ac-92e4-4b76-8ce2-276d2c0e68ef

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Techniques: T1566 T1203

CVE tags: CVE-2021-33771CVE-2021-31979

Download From Suspicious TLD - Whitelist lowtest

Author: Florian Roth (Nextron Systems) · 2017-03-13 (modified 2023-05-18) · logsource: category=proxy · b5de2919-b74a-4805-91a7-5049accbaefe

Detects executable downloads from suspicious remote systems

Techniques: T1566 T1203 T1204.002

Suspicious Microsoft OneNote Child Process hightest

Author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea) · 2022-10-21 (modified 2023-02-10) · logsource: product=windows category=process_creation · c27515df-97a9-4162-8a60-dc0eeb51b775

Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.

Techniques: T1566 T1566.001

Potential Initial Access via DLL Search Order Hijacking mediumtest

Author: Tim Rauch (rule), Elastic (idea) · 2022-10-21 · logsource: product=windows category=file_event · dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c

Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.

Techniques: T1566 T1566.001 T1574 T1574.001

Suspicious HH.EXE Execution hightest

Author: Maxim Pavlunin · 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · e8a95b5e-c891-46e2-b33a-93937d3abc31

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

Techniques: T1047 T1059.001 T1059.003 T1059.005 T1059.007 T1218 T1218.001 T1218.010 T1218.011 T1566 T1566.001

Okta FastPass Phishing Detection hightest

Author: Austin Songer @austinsonger · 2023-05-07 (modified 2026-04-27) · logsource: product=okta service=okta · ee39a9f7-5a79-4b0a-9815-d36b3cf28d3e

Detects when Okta FastPass prevents a known phishing site.

Techniques: T1566

Phishing Pattern ISO in Archive hightest

Author: Florian Roth (Nextron Systems) · 2022-06-07 · logsource: product=windows category=process_creation · fcdf69e5-a3d3-452a-9724-26f2308bf2b1

Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)