T1566.001 Phishing: Spearphishing Attachment

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. MITRE ATT&CK

1 program on CmdID 11 Sigma rules T1566.001 on attack.mitre.org

Part of

MITRE ATT&CK

T1566Phishing

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

criticalExploit for CVE-2017-8759Florian Roth (Nextron Systems) · Windows

highHTML Help HH.EXE Suspicious Child ProcessMaxim Pavlunin, Nasreddine Bencherchali (Nextron Systems) · Windows

highSuspicious Double Extension File ExecutionFlorian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems) · Windows

highSuspicious HH.EXE ExecutionMaxim Pavlunin · Windows

highSuspicious HWP Sub ProcessesFlorian Roth (Nextron Systems) · Windows

highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea) · Windows

mediumDisk Image Mounting Via Hdiutil - MacOSOmar Khaled (@beacon_exe) · macOS

mediumExploit for CVE-2017-0261Florian Roth (Nextron Systems) · Windows

everyday examples from tldr-pages, CC BY 4.0

Mount an image on the page for hdiutil

hdiutil attach path/to/image_fileIdentify

An example is here when CmdID’s reading of it names T1566.001: a Sigma rule it trips is tagged with it, or its abuse is documented as it.