T1566 Phishing

Adversaries may send phishing messages to gain access to victim systems. MITRE ATT&CK

1 program on CmdID 5 Sigma rules T1566 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK

T1566.001Phishing: Spearphishing Attachment

T1566.002Phishing: Spearphishing Link

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

highHTML Help HH.EXE Suspicious Child ProcessMaxim Pavlunin, Nasreddine Bencherchali (Nextron Systems) · Windows

highPhishing Pattern ISO in ArchiveFlorian Roth (Nextron Systems) · Windows

highSuspicious HH.EXE ExecutionMaxim Pavlunin · Windows

highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea) · Windows

mediumSuspicious Execution via macOS Script EditorTim Rauch (rule), Elastic (idea) · macOS