// MITRE ATT&CK
T1566.001 · Spearphishing Attachment
Sub-technique of T1566 · Phishing.
Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attache...
How to detect & mitigate it
Detecting Spearphishing Attachment starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.
Related techniques
T1195.001
Compromise Software Dependencies and Development Tools T1566.002
Spearphishing Link T1195.003
Compromise Hardware Supply Chain T1195
Supply Chain Compromise T1190
Exploit Public-Facing Application T1659
Content Injection T1199
Trusted Relationship T1566
Phishing
Compromise Software Dependencies and Development Tools T1566.002
Spearphishing Link T1195.003
Compromise Hardware Supply Chain T1195
Supply Chain Compromise T1190
Exploit Public-Facing Application T1659
Content Injection T1199
Trusted Relationship T1566
Phishing
Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.