Cross-source coverage
T1566.003 / ATT&CK
Phishing: Spearphishing via Service
2 rules across 1 source.
From MITRE ATT&CK 19.2
Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.
All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries will create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and software that's running in an environment. The adversary can then send malicious links or attachments through these services.
A common example is to build rapport with a target via social media, then send content to a personal webmail service that the target uses on their work computer. This allows an adversary to bypass some email restrictions on the work account, and the target is more likely to open the file since it's something they were expecting. If the payload doesn't work as expected, the adversary can continue normal communications and troubleshoot with the target on how to get it working.
- Tactics
- Initial Access
- Platforms
- Linux · macOS · Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLlinux:syslogNSM:Flowmacos:unifiedlog
How MITRE says to detect it DET0115
Detection Strategy for Spearphishing via a Service across OS Platforms
Windows Analytic 0320
Inbound spearphishing attempts delivered via third-party services (e.g., Gmail, LinkedIn messages) leading to malicious file downloads or browser-initiated script execution. Defender view includes correlation of external service logins, unexpected file write operations, and suspicious descendant processes spawned from productivity or browser applications.
WinEventLog:SecurityEventCode=4688WinEventLog:SysmonEventCode=11WinEventLog:SysmonEventCode=3, 22
Linux Analytic 0321
Use of non-enterprise email or messaging services in Thunderbird, Evolution, or browsers leading to suspicious file downloads and subsequent execution. Defender view includes browser-initiated downloads of unexpected content and shell or interpreter processes launched post-download.
auditd:SYSCALLexecve: Execution of bash, python, or perl processes spawned by browser/email clientlinux:syslogInbound messages from webmail services containing attachments or URLsNSM:FlowOutbound traffic to domains/IPs not previously resolved, occurring shortly after attachment download or link click
macOS Analytic 0322
Phishing attempts via iCloud Mail, Gmail, or social media apps accessed on macOS systems. Defender view includes Mail.app or Safari downloads of files followed by osascript, Terminal, or abnormal child process execution.
macos:unifiedlogReceived messages containing embedded links or attachments from non-enterprise servicesmacos:unifiedlogExecution of osascript, bash, or Terminal initiated from Mail.app or Safarimacos:unifiedlogSuspicious outbound HTTPS requests to domains flagged as newly registered or untrusted after spearphishing message interaction
elastic/detection-rules
2 rules| Detection | Severity | Format |
|---|---|---|
| M365 Teams Rogue Help Desk Chat Created | High | Elastic TOML |
| M365 Azure Monitor Alert Email with Financial or Billing Theme | Low | Elastic TOML |