Cross-source coverage

T1566.002 / ATT&CK

Phishing: Spearphishing Link

79 rules · 77 families across 8 sources.

1 atomic-IOC hidden · include

Showing deprecated rules · back to the default

From MITRE ATT&CK 19.2

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.

All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging User Execution. The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place.

Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an "IDN homograph attack"). URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, hxxp://google.com@1157586937.

Adversaries may also utilize links to perform consent phishing/spearphishing campaigns to Steal Application Access Tokens that grant immediate access to the victim environment. For example, a user may be lured into granting adversaries permissions/access via a malicious OAuth 2.0 request URL that when accepted by the user provide permissions/access for malicious applications. These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls.

Similarly, malicious links may also target device-based authorization, such as OAuth 2.0 device authorization grant flow which is typically used to authenticate devices without UIs/browsers. Known as “device code phishing,” an adversary may send a link that directs the victim to a malicious authorization page where the user is tricked into entering a code/credentials that produces a device token.

Tactics
Initial Access
Platforms
Identity Provider · Linux · macOS · Office Suite · SaaS · Windows
Telemetry
m365:unifiedWinEventLog:SecurityWinEventLog:SysmonApplication:Mailauditd:SYSCALLNSM:Flowmacos:unifiedlogazure:signinlogs

How MITRE says to detect it DET0107

Detection Strategy for Spearphishing Links

Windows Analytic 0298

Correlation of inbound emails with embedded links followed by user-driven browser navigation to suspicious or obfuscated domains. Detection chain includes malicious URL in email → user click recorded in Office logs → browser process spawning unusual child processes (e.g., PowerShell, cmd) or download activity.

  • m365:unified Send/Receive: Inbound emails containing embedded or shortened URLs
  • WinEventLog:Security EventCode=4688
  • WinEventLog:Sysmon EventCode=3, 22

Linux Analytic 0299

Detection of spearphishing links through mail logs and browser activity. Behavior includes email with suspicious URLs → user click recorded in mail/web proxy logs → shell or interpreter launched from browser process.

  • Application:Mail Inbound emails containing hyperlinks from suspicious sources
  • auditd:SYSCALL execve: Execution of scripts or binaries spawned from browser processes
  • NSM:Flow Outbound requests to domains not previously resolved or associated with phishing campaigns

macOS Analytic 0300

Correlation of Mail.app logs with Safari/Chrome activity. Suspicious behavior includes email links → Safari/Chrome accessing newly registered or lookalike domains → osascript or Terminal spawned unexpectedly.

  • macos:unifiedlog Received messages with embedded or shortened URLs
  • macos:unifiedlog Browser processes launching unexpected interpreters (osascript, bash)
  • macos:unifiedlog Connections to suspicious domains with mismatched certificate or unusual patterns

Identity Provider Analytic 0301

Detection of OAuth consent phishing or malicious login attempts initiated through spearphishing links. Behavior chain includes inbound email with OAuth URL → consent page visited → unusual token grants logged in IdP logs.

  • azure:signinlogs ConsentGrant: Suspicious consent grants to non-approved or unknown applications

View on attack.mitre.org ↗

elastic/detection-rules

35 rules
Detection Severity Format
Entra ID Concurrent Sign-in with Suspicious Properties High Elastic TOML
Entra ID Kali365 Default User-Agent Detected High Elastic TOML
Entra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN High Elastic TOML
Entra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent High Elastic TOML
Entra ID OAuth Device Code Flow with Concurrent Sign-ins High Elastic TOML
Entra ID OAuth Device Code Phishing via AiTM High Elastic TOML
Entra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS) High Elastic TOML
Execution of File Written or Modified by Microsoft Office High Elastic TOML
Google Workspace Device Registration After OAuth from Suspicious ASN High Elastic TOML
Google Workspace Object Copied from External Drive with App Consent High Elastic TOML

+ 25 more from elastic/detection-rules → showing the 10 highest-severity

elastic/protections-artifacts

19 rules · 18 families
Detection Severity Format
Command Shell Execution from Untrusted Origin Undefined Elastic TOML
Embedded Executable via Windows Shortcut File Undefined Elastic TOML
Execution of File Written or Modified by Microsoft Office Undefined Elastic TOML
Potential ClickFix Attack via Base64 Decoded Payload Undefined Elastic TOML
Potential ClickFix Attack via Windows Terminal Undefined Elastic TOML
Potential Execution via LNK Stomping Undefined Elastic TOML
Potential Execution via VS Code Tasks 2 variants Undefined Elastic TOML
Potential Execution via VS Code Tasks 2 variants Undefined Elastic TOML
Potential Payload Download via Finger LOLBin Undefined Elastic TOML
RunDLL32/Regsvr32 Loads Dropped Executable Undefined Elastic TOML

+ 9 more from elastic/protections-artifacts → showing the 10 highest-severity

splunk/security_content

9 rules
Detection Severity Format
Azure AD Device Code Authentication Undefined SPL
O365 Email Reported By Admin Found Malicious Undefined SPL
O365 Email Reported By User Found Malicious Undefined SPL
O365 Threat Intelligence Suspicious Email Delivered Undefined SPL
O365 ZAP Activity Detection Undefined SPL
Process Creating LNK file in Suspicious Location Undefined SPL
Windows Defender ASR Audit Events Undefined SPL
Windows Defender ASR Block Events Undefined SPL
Windows Defender ASR Rules Stacking Undefined SPL

Bert-JanP/Hunting-Queries-Detection-Rules

6 rules
Detection Severity Format
MITRE ATT&CK Mapping Undefined KQL
Potential Phishing Campaign Undefined KQL
Safe Links Email URL Block Trigger Undefined KQL
Successful device code sign-in Undefined KQL
Successful device code sign-in from unmanaged device Undefined KQL
TTP Detection Rule: Check for Phishing Emails Using IPFS in Phishing Campaigns Undefined KQL

SigmaHQ/sigma

3 rules
Detection Severity Format
Potential Malicious Usage of CloudTrail System Manager High Sigma
Suspicious Email Delivered In Microsoft 365 Medium Sigma
Suspicious Execution via macOS Script Editor Medium Sigma

panther-labs/panther-analysis

3 rules
Detection Severity Format
Gmail Potential Spoofed Email Delivered High Panther Python
Gsuite Link Clicked in Spam Email High Panther Python
Azure Device Code Authentication with Broker Client Medium Panther Python

Azure/Azure-Sentinel

2 rules
Detection Severity Format
Raw IP Address Used as URL Domain Undefined KQL
User navigation to redirected URL Undefined KQL

chronicle/detection-rules

2 rules
Detection Severity Format
chrome_browser_safe_browsing_user_bypass Low YARA-L
detect_possible_execution_of_phishing_attachment Undefined YARA-L

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.