Cross-source coverage

T1566 / ATT&CK

Phishing

1794 rules · 1700 families across 12 sources.

114 deprecated hidden · include 260 atomic-IOC hidden · include

From MITRE ATT&CK 19.2

Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.

Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules). Another way to accomplish this is by Email Spoofing the identity of the sender, which can be used to fool both the human recipient as well as automated security tools, or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., "thread hijacking").

Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools onto their computer (i.e., User Execution).

Tactics: Initial Access
Platforms: Identity Provider · Linux · macOS · Office Suite · SaaS · Windows
Telemetry: m365:unifiedWinEventLog:SysmonApplication:Mailauditd:SYSCALLmacos:unifiedlogazure:signinlogssaas:collaboration

How MITRE says to detect it DET0070

Detection Strategy for Phishing across platforms.

Windows Analytic 0188

Unusual inbound email activity where attachments or embedded URLs are delivered to users followed by execution of new processes or suspicious document behavior. Detection involves correlating email metadata, file creation, and network activity after a phishing message is received.

m365:unified Send/Receive: Emails with suspicious sender domains, spoofed headers, or anomalous attachment types
WinEventLog:Sysmon EventCode=11
WinEventLog:Sysmon EventCode=1

Linux Analytic 0189

Monitor for malicious payload delivery through phishing where attachments or URLs in email clients (e.g., Thunderbird, mutt) result in unusual file creation or outbound network connections. Focus on correlation between mail logs, file writes, and execution activity.

Application:Mail Inbound messages with anomalous headers, spoofed SPF/DKIM failures
auditd:SYSCALL execve: Execution of scripts or binaries sourced from mail directories (/var/mail, ~/Maildir)

macOS Analytic 0190

Detection of phishing through anomalous Mail app activity, such as attachments saved to disk and immediately executed, or Safari/Preview launching URLs and files linked from email messages. Correlate UnifiedLogs events with subsequent process execution.

macos:unifiedlog Inbound email activity with suspicious domains or mismatched sender information
macos:unifiedlog Preview.app, Safari.app, or Mail.app spawning new processes outside normal patterns

Office Suite Analytic 0191

Phishing via Office documents containing embedded macros or links that spawn processes. Detection relies on correlating Office application logs with suspicious child process execution and outbound network connections.

m365:unified FileAccessed: Access of email attachments by Office applications
WinEventLog:Sysmon EventCode=1

Identity Provider Analytic 0192

Phishing attempts targeting IdPs often manifest as anomalous login attempts from suspicious email invitations or fake SSO prompts. Detection correlates login flows, MFA bypass attempts, and anomalous geographic patterns following phishing email delivery.

azure:signinlogs Failed MFA attempts, unusual conditional access triggers, login attempts from unexpected IP ranges

SaaS Analytic 0193

Phishing delivered via SaaS services (chat, collaboration platforms) where messages contain malicious URLs or attachments. Detect anomalous link clicks, suspicious file uploads, or token misuse after SaaS-based phishing attempts.

saas:collaboration MessagePosted: Suspicious links or attachment delivery via collaboration tools (Slack, Teams, Zoom)

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 1794 above — a rule tagged a sub-technique covers this technique too.

Emerging Threats Open

1285 rules · 1200 families

Detection	Severity	Format
ET HUNTING HTTP POST to .php on Appspot Hosting - Possible Phishing	Critical	Suricata
ET HUNTING Possible Phishing Page - Page Saved with SingleFile Extension	Critical	Suricata
ET HUNTING Suspicious Glitch Hosted GET Request - Possible Phishing Landing	Critical	Suricata
ET HUNTING Suspicious HTTP POST Only Containing Pass - Possible Phishing	Critical	Suricata
ET HUNTING Suspicious HTTP POST Only Containing Password - Possible Phishing	Critical	Suricata
ET HUNTING Suspicious Netlify Hosted DNS Request - Possible Phishing Landing	Critical	Suricata
ET HUNTING Suspicious Netlify Hosted GET Request - Possible Phishing Landing	Critical	Suricata
ET HUNTING Suspicious Netlify Hosted TLS SNI Request - Possible Phishing Landing	Critical	Suricata
ET INFO Killbot JS Configuration - Possible Phishing	Critical	Suricata
ET PHISHING 401TRG Successful Multi-Email Phish - Observed in Docusign/Dropbox/Onedrive/Gdrive Nov 02 2017	Critical	Suricata

+ 1275 more from Emerging Threats Open → showing the 10 highest-severity

Azure/Azure-Sentinel

243 rules · 242 families

Detection	Severity	Format
Star Blizzard C2 Domains August 2022	High	KQL
Star Blizzard-Domain IOCs	High	KQL
Phishing link click observed in Network Traffic	Medium	KQL
Admin Submissions by DetectionMethod (Phish FP)	Undefined	KQL
Admin Submissions by DetectionMethod (Spam FP)	Undefined	KQL
Admin Submissions by Detection Type	Undefined	KQL
Admin Submissions by Grading verdict (FN-FP)	Undefined	KQL
Admin Submissions by Submission State (FN)	Undefined	KQL
Admin Submissions by Submission State (FP)	Undefined	KQL
Admin Submissions by Submission Type (FN)	Undefined	KQL

+ 233 more from Azure/Azure-Sentinel → showing the 10 highest-severity

elastic/protections-artifacts

81 rules · 80 families

Detection	Severity	Format
Command Shell Execution from Untrusted Origin	Undefined	Elastic TOML
DLL Loaded from a Macro Enabled Document	Undefined	Elastic TOML
DLL Side Loading of a file dropped by Microsoft Office	Undefined	Elastic TOML
Embedded Executable via Windows Shortcut File	Undefined	Elastic TOML
Execution from a Downloaded ISO File	Undefined	Elastic TOML
Execution from a Macro Enabled Office Document	Undefined	Elastic TOML
Execution from a Remote Working Directory	Undefined	Elastic TOML
Execution of Commonly Abused Utilities via Explorer Trampoline	Undefined	Elastic TOML
Execution of File Written or Modified by Microsoft Equation Editor	Undefined	Elastic TOML
Execution of File Written or Modified by Microsoft Office	Undefined	Elastic TOML

+ 71 more from elastic/protections-artifacts → showing the 10 highest-severity

elastic/detection-rules

52 rules

Detection	Severity	Format
Entra ID Concurrent Sign-in with Suspicious Properties	High	Elastic TOML
Entra ID Kali365 Default User-Agent Detected	High	Elastic TOML
Entra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN	High	Elastic TOML
Entra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent	High	Elastic TOML
Entra ID OAuth Device Code Flow with Concurrent Sign-ins	High	Elastic TOML
Entra ID OAuth Device Code Phishing via AiTM	High	Elastic TOML
Entra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS)	High	Elastic TOML
Entra ID Potential AiTM Sign-In via OfficeHome (Tycoon2FA)	High	Elastic TOML
Execution of File Written or Modified by Microsoft Office	High	Elastic TOML
Google Workspace Device Registration After OAuth from Suspicious ASN	High	Elastic TOML

+ 42 more from elastic/detection-rules → showing the 10 highest-severity

splunk/security_content

51 rules

Detection	Severity	Format
Azure AD Device Code Authentication	Undefined	SPL
Detect Outlook exe writing a zip file	Undefined	SPL
Email Attachments With Lots Of Spaces	Undefined	SPL
Gdrive suspicious file sharing	Undefined	SPL
GSuite Email Suspicious Attachment	Undefined	SPL
Gsuite Email Suspicious Subject With Attachment	Undefined	SPL
Gsuite Email With Known Abuse Web Service Link	Undefined	SPL
Gsuite suspicious calendar invite	Undefined	SPL
Gsuite Suspicious Shared File Name	Undefined	SPL
Linux Ghostscript Exploitation	Undefined	SPL

+ 41 more from splunk/security_content → showing the 10 highest-severity

SigmaHQ/sigma

33 rules

Detection	Severity	Format
CVE-2021-31979 CVE-2021-33771 Exploits	Critical	Sigma
CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum	Critical	Sigma
Droppers Exploiting CVE-2017-11882	Critical	Sigma
Exploit for CVE-2017-8759	Critical	Sigma
HTML Help HH.EXE Suspicious Child Process	High	Sigma
ISO File Created Within Temp Folders	High	Sigma
Office Macro File Creation From Suspicious Process	High	Sigma
Okta FastPass Phishing Detection	High	Sigma
Password Protected ZIP File Opened (Email Attachment)	High	Sigma
Phishing Pattern ISO in Archive	High	Sigma

+ 23 more from SigmaHQ/sigma → showing the 10 highest-severity

panther-labs/panther-analysis

24 rules

Detection	Severity	Format
GSuite Government Backed Attack	Critical	Panther Python
Slack Potentially Malicious File Shared	Critical	Panther Python
DNS request to denylisted domain	High	Panther Python
Gmail Malicious SMTP Response	High	Panther Python
Gmail Potential Spoofed Email Delivered	High	Panther Python
Gsuite Attachments Downloaded from Spam Email	High	Panther Python
Gsuite Link Clicked in Spam Email	High	Panther Python
Malware Detected in Email	High	Panther Python
Okta AiTM Phishing Attempt Blocked by FastPass	High	Panther Python
Proofpoint Active Threat Campaign Detected	High	Panther Python

+ 14 more from panther-labs/panther-analysis → showing the 10 highest-severity

Bert-JanP/Hunting-Queries-Detection-Rules

13 rules

Detection	Severity	Format
Anomalous Amount of URLClickEvents	Undefined	KQL
ASR Executable Content triggered	Undefined	KQL
AsyncRAT Initial Access Campaign via OneNote files	Undefined	KQL
Executable Fileattachment recieved	Undefined	KQL
Macro attachment opened from rare sender	Undefined	KQL
Malicious email delivered in Microsoft 365	Undefined	KQL
MITRE ATT&CK Mapping	Undefined	KQL
Potential Phishing Campaign	Undefined	KQL
Safe Links Email URL Block Trigger	Undefined	KQL
Successful device code sign-in	Undefined	KQL

+ 3 more from Bert-JanP/Hunting-Queries-Detection-Rules → showing the 10 highest-severity

chainguard-dev/osquery-defense-kit

5 rules · 4 families

Detection	Severity	Format
Look for sketchy mounted disk images, inspired by Shlayer 2 variants	Undefined	osquery SQL
Look for sketchy mounted disk images, inspired by Shlayer 2 variants	Undefined	osquery SQL
Scan removable volumes for sketchy files	Undefined	osquery SQL
Surface ISO/DMG disk images that were downloaded from unexpected places	Undefined	osquery SQL
Surface webmail downloads of an unexpected sort	Undefined	osquery SQL

chronicle/detection-rules

4 rules

Detection	Severity	Format
entra_id_devicecode_phishing_attack	High	YARA-L
gmail_spike_in_undeliverables	Medium	YARA-L
okta_phishing_detection_with_fastpass_origin_check	Medium	YARA-L
chrome_browser_safe_browsing_user_bypass	Low	YARA-L

socfortress/Wazuh-Rules

2 rules

Detection	Severity	Format
operation. · office_365.Operation = UserSubmissionTriage	High	Wazuh XML
Sysmon - Event 1: Process creation · PowerShell Encoded Command (Paste and Run) (T1566.002)	Medium	Wazuh XML

Wazuh Core Ruleset

1 rule

Detection	Severity	Format
MS Graph message: A phishing email has been detected. This is a true positive alert.	Medium	Wazuh XML