{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1566","id":"T1566","name":"Phishing","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1566","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"8152ecb1c4cc2446f5ff534a3153cec23ed82838bbda16101ad9144b28592c09","description":"Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.\n\nAdversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services (like social media platforms) or delivered via calendar invites. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., [Email Hiding Rules](https://attack.mitre.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spam 2022)(Citation: Palo Alto Unit 42 VBA Infostealer 2014) Another way to accomplish this is by [Email Spoofing](https://attack.mitre.org/techniques/T1684/002)(Citation: Proofpoint-spoof) the identity of the sender, which can be used to fool both the human recipient as well as automated security tools,(Citation: cyberproof-double-bounce) or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., \"thread hijacking\").(Citation: phishing-krebs)\n\nVictims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,(Citation: sygnia Luna Month)(Citation: CISA Remote Monitoring and Management Software) or install adversary-accessible remote management tools onto their computer (i.e., [User Execution](https://attack.mitre.org/techniques/T1204)).(Citation: Unit42 Luna Moth)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1566","external_id":"T1566"},{"source_name":"phishing-krebs","description":"Brian Krebs. (2024, March 28). Thread Hijacking: Phishes That Prey on Your Curiosity. Retrieved September 27, 2024.","url":"https://krebsonsecurity.com/2024/03/thread-hijacking-phishes-that-prey-on-your-curiosity/"},{"source_name":"CISA Remote Monitoring and Management Software","description":"CISA. (n.d.). Protecting Against Malicious Use of Remote Monitoring and Management Software. Retrieved February 2, 2023.","url":"https://www.cisa.gov/uscert/ncas/alerts/aa23-025a"},{"source_name":"cyberproof-double-bounce","description":"Itkin, Liora. (2022, September 1). Double-bounced attacks with email spoofing . Retrieved February 24, 2023.","url":"https://blog.cyberproof.com/blog/double-bounced-attacks-with-email-spoofing-2022-trends"},{"source_name":"Unit42 Luna Moth","description":"Kristopher Russo. (n.d.). Luna Moth Callback Phishing Campaign. Retrieved February 2, 2023.","url":"https://unit42.paloaltonetworks.com/luna-moth-callback-phishing/"},{"source_name":"Microsoft OAuth Spam 2022","description":"Microsoft. (2023, September 22). Malicious OAuth applications abuse cloud email services to spread spam. Retrieved March 13, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/"},{"source_name":"sygnia Luna Month","description":"Oren Biderman, Tomer Lahiyani, Noam Lifshitz, Ori Porag. (n.d.). LUNA MOTH: THE THREAT ACTORS BEHIND RECENT FALSE SUBSCRIPTION SCAMS. Retrieved February 2, 2023.","url":"https://blog.sygnia.co/luna-moth-false-subscription-scams"},{"source_name":"Proofpoint-spoof","description":"Proofpoint. (n.d.). What Is Email Spoofing?. Retrieved February 24, 2023.","url":"https://www.proofpoint.com/us/threat-reference/email-spoofing"},{"source_name":"Palo Alto Unit 42 VBA Infostealer 2014","description":"Vicky Ray and Rob Downs. (2014, October 29). Examining a VBA-Initiated Infostealer Campaign. Retrieved March 13, 2023.","url":"https://unit42.paloaltonetworks.com/examining-vba-initiated-infostealer-campaign/"}],"platforms":["Identity Provider","Linux","macOS","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","identity","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1566.001","id":"T1566.001","name":"Spearphishing Attachment","page":"techniques/enterprise/T1566.001/"},{"key":"enterprise/T1566.002","id":"T1566.002","name":"Spearphishing Link","page":"techniques/enterprise/T1566.002/"},{"key":"enterprise/T1566.003","id":"T1566.003","name":"Spearphishing via Service","page":"techniques/enterprise/T1566.003/"},{"key":"enterprise/T1566.004","id":"T1566.004","name":"Spearphishing Voice","page":"techniques/enterprise/T1566.004/"}],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0067","name":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of a logon session with account and logon-type context.","collection_focus":"Enable Audit Logon and collect successful session creation on the receiving host; join session/logon IDs rather than only account names.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["account","logon_id","logon_type","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1566","id":"T1566","name":"Phishing","domain":"enterprise","platforms":["Identity Provider","Linux","macOS","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","identity","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1566","technique_page":"techniques/enterprise/T1566/","page":"detections/enterprise/T1566/","status":"rule_source_available","counts":{"sigma":11,"atlas_basic":0,"atlas_anomaly":2,"strategies":1,"analytics":6,"live_validated":0},"sigma_rules":[{"id":"38e7f511-3f74-41d4-836e-f57dfa18eead","title":"Potential Malicious Usage of CloudTrail System Manager","status":"test","level":"high","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/38e7f511-3f74-41d4-836e-f57dfa18eead.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_cloudtrail_ssm_malicious_usage.yml","author":"jamesc-grafana","kind":"sigma"},{"id":"ee39a9f7-5a79-4b0a-9815-d36b3cf28d3e","title":"Okta FastPass Phishing Detection","status":"test","level":"high","logsource":{"product":"okta","service":"okta"},"data_path":"data/detection-rules/ee39a9f7-5a79-4b0a-9815-d36b3cf28d3e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/identity/okta/okta_fastpass_phishing_detection.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4","title":"Suspicious Execution via macOS Script Editor","status":"test","level":"medium","logsource":{"category":"process_creation","product":"macos"},"data_path":"data/detection-rules/6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_susp_execution_macos_script_editor.yml","author":"Tim Rauch (rule), Elastic (idea)","kind":"sigma"},{"id":"00d0b5ab-1f55-4120-8e83-487c0a7baf19","title":"Download From Suspicious TLD - Blacklist","status":"test","level":"low","logsource":{"category":"proxy"},"data_path":"data/detection-rules/00d0b5ab-1f55-4120-8e83-487c0a7baf19.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_download_susp_tlds_blacklist.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"b5de2919-b74a-4805-91a7-5049accbaefe","title":"Download From Suspicious TLD - Whitelist","status":"test","level":"low","logsource":{"category":"proxy"},"data_path":"data/detection-rules/b5de2919-b74a-4805-91a7-5049accbaefe.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_download_susp_tlds_whitelist.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"1ae64f96-72b6-48b3-ad3d-e71dff6c6398","title":"Suspicious External WebDAV Execution","status":"test","level":"high","logsource":{"category":"proxy"},"data_path":"data/detection-rules/1ae64f96-72b6-48b3-ad3d-e71dff6c6398.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_webdav_external_execution.yml","author":"Ahmed Farouk","kind":"sigma"},{"id":"dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c","title":"Potential Initial Access via DLL Search Order Hijacking","status":"test","level":"medium","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_initial_access_dll_search_order_hijacking.yml","author":"Tim Rauch (rule), Elastic (idea)","kind":"sigma"},{"id":"52cad028-0ff0-4854-8f67-d25dfcbc78b4","title":"HTML Help HH.EXE Suspicious Child Process","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/52cad028-0ff0-4854-8f67-d25dfcbc78b4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hh_html_help_susp_child_process.yml","author":"Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"e8a95b5e-c891-46e2-b33a-93937d3abc31","title":"Suspicious HH.EXE Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/e8a95b5e-c891-46e2-b33a-93937d3abc31.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hh_susp_execution.yml","author":"Maxim Pavlunin","kind":"sigma"},{"id":"c27515df-97a9-4162-8a60-dc0eeb51b775","title":"Suspicious Microsoft OneNote Child Process","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/c27515df-97a9-4162-8a60-dc0eeb51b775.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_office_onenote_susp_child_processes.yml","author":"Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)","kind":"sigma"},{"id":"fcdf69e5-a3d3-452a-9724-26f2308bf2b1","title":"Phishing Pattern ISO in Archive","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/fcdf69e5-a3d3-452a-9724-26f2308bf2b1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_archiver_iso_phishing.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[{"id":"atlas-anomaly-t1566-1","technique_id":"T1566","title":"Malicious attachment, link, or message delivery — T1566 Phishing","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#phishing-delivery","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":32,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L32","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"ebb76511774cefd6d4a6a73dfc0549ce507ad9ed8abb43c602d80b8f210f81a1","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"sender-recipient relationship and message feature vector.","expected_behavior":"established senders use recurring infrastructure, content types, and recipient groups.","deviation":"first-seen sender-recipient edge combined with unusual attachment, URL, or message characteristics.","anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Novel-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#85-novel-category-anomaly"},{"title":"Multivariate Combination Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#48-multivariate-combination-anomaly"}],"log_sources":[{"title":"Email Gateway Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#72-email-gateway-logs"},{"title":"Mailbox Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#97-mailbox-audit-logs"}],"context_references":[{"title":"Truebot joint advisory — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/ic3-aa23-187a-truebot.pdf"},{"title":"original source","url":"https://www.ic3.gov/CSA/2023/230707.pdf"}]},{"id":"atlas-anomaly-t1566-2","technique_id":"T1566","title":"User opens delivered content followed by execution — T1566 Phishing","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#phishing-execution-sequence","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":33,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L33","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"17bf1dc2e48b259eb4871390e32f4e49a041dbb41b8df39c23b83e929aef4f8e","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"user and endpoint event sequence.","expected_behavior":"opening messages or documents rarely transitions directly to script or command execution.","deviation":"low-probability communication-to-file-to-process transition.","anomaly_types":[{"title":"Sequence-Order Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#60-sequence-order-anomaly"},{"title":"Transition Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#61-transition-anomaly"},{"title":"Cross-View Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#93-cross-view-anomaly"}],"log_sources":[{"title":"Email Gateway Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#72-email-gateway-logs"},{"title":"File-System Activity Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#13-file-system-activity-logs"},{"title":"Process Execution Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#6-process-execution-logs"}],"context_references":[{"title":"Truebot joint advisory — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/ic3-aa23-187a-truebot.pdf"},{"title":"original source","url":"https://www.ic3.gov/CSA/2023/230707.pdf"}]}],"anomaly_types":[{"title":"Cross-View Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#93-cross-view-anomaly"},{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Multivariate Combination Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#48-multivariate-combination-anomaly"},{"title":"Novel-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#85-novel-category-anomaly"},{"title":"Sequence-Order Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#60-sequence-order-anomaly"},{"title":"Transition Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#61-transition-anomaly"}],"strategies":[{"id":"DET0070","name":"Detection Strategy for Phishing across platforms.","url":"https://attack.mitre.org/detectionstrategies/DET0070","stix_id":"x-mitre-detection-strategy--7ee73f2e-76b2-4f00-bcc0-7fb79d31d344","relationship_id":"relationship--90a84c7a-e685-4ec1-8195-69eea3fc1507","description":"","analytics":[{"id":"AN0188","name":"Analytic 0188","guidance":"Unusual inbound email activity where attachments or embedded URLs are delivered to users followed by execution of new processes or suspicious document behavior. Detection involves correlating email metadata, file creation, and network activity after a phishing message is received.","url":"https://attack.mitre.org/detectionstrategies/DET0070#AN0188","platforms":["Windows"],"tuning":[{"field":"SuspiciousFileTypes","description":"Attachment types considered high risk (e.g., .exe, .js, .vbs, .scr, macro-enabled docs)."},{"field":"AllowedSenders","description":"Whitelist of known trusted senders to reduce false positives."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"m365:unified","channel":"Send/Receive: Emails with suspicious sender domains, spoofed headers, or anomalous attachment types","platforms":["Windows"],"analytic_id":"AN0188","source_url":"https://attack.mitre.org/detectionstrategies/DET0070#AN0188","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0039","component":"File Creation","name":"WinEventLog:Sysmon","channel":"EventCode=11","platforms":["Windows"],"analytic_id":"AN0188","source_url":"https://attack.mitre.org/detectionstrategies/DET0070#AN0188","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0188","source_url":"https://attack.mitre.org/detectionstrategies/DET0070#AN0188","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0189","name":"Analytic 0189","guidance":"Monitor for malicious payload delivery through phishing where attachments or URLs in email clients (e.g., Thunderbird, mutt) result in unusual file creation or outbound network connections. Focus on correlation between mail logs, file writes, and execution activity.","url":"https://attack.mitre.org/detectionstrategies/DET0070#AN0189","platforms":["Linux"],"tuning":[{"field":"MonitoredMailPaths","description":"System or user directories where emails/attachments are stored."},{"field":"AttachmentHashBaseline","description":"Known good hashes for common business document templates."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"Application:Mail","channel":"Inbound messages with anomalous headers, spoofed SPF/DKIM failures","platforms":["Linux"],"analytic_id":"AN0189","source_url":"https://attack.mitre.org/detectionstrategies/DET0070#AN0189","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve: Execution of scripts or binaries sourced from mail directories (/var/mail, ~/Maildir)","platforms":["Linux"],"analytic_id":"AN0189","source_url":"https://attack.mitre.org/detectionstrategies/DET0070#AN0189","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0190","name":"Analytic 0190","guidance":"Detection of phishing through anomalous Mail app activity, such as attachments saved to disk and immediately executed, or Safari/Preview launching URLs and files linked from email messages. Correlate UnifiedLogs events with subsequent process execution.","url":"https://attack.mitre.org/detectionstrategies/DET0070#AN0190","platforms":["macOS"],"tuning":[{"field":"SuspiciousDomains","description":"List of domains known for phishing activity or suspicious sender infrastructure."},{"field":"ExecutionDelayWindow","description":"Time threshold between file save and execution considered suspicious."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"macos:unifiedlog","channel":"Inbound email activity with suspicious domains or mismatched sender information","platforms":["macOS"],"analytic_id":"AN0190","source_url":"https://attack.mitre.org/detectionstrategies/DET0070#AN0190","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"Preview.app, Safari.app, or Mail.app spawning new processes outside normal patterns","platforms":["macOS"],"analytic_id":"AN0190","source_url":"https://attack.mitre.org/detectionstrategies/DET0070#AN0190","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0191","name":"Analytic 0191","guidance":"Phishing via Office documents containing embedded macros or links that spawn processes. Detection relies on correlating Office application logs with suspicious child process execution and outbound network connections.","url":"https://attack.mitre.org/detectionstrategies/DET0070#AN0191","platforms":["Office Suite"],"tuning":[{"field":"ParentProcessList","description":"Parent processes expected to execute child processes (e.g., Office apps)."},{"field":"MacroExecutionThreshold","description":"Threshold for number of macros executed before raising alerts."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"m365:unified","channel":"FileAccessed: Access of email attachments by Office applications","platforms":["Office Suite"],"analytic_id":"AN0191","source_url":"https://attack.mitre.org/detectionstrategies/DET0070#AN0191","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Office Suite"],"analytic_id":"AN0191","source_url":"https://attack.mitre.org/detectionstrategies/DET0070#AN0191","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0192","name":"Analytic 0192","guidance":"Phishing attempts targeting IdPs often manifest as anomalous login attempts from suspicious email invitations or fake SSO prompts. Detection correlates login flows, MFA bypass attempts, and anomalous geographic patterns following phishing email delivery.","url":"https://attack.mitre.org/detectionstrategies/DET0070#AN0192","platforms":["Identity Provider"],"tuning":[{"field":"GeoAnomalyThreshold","description":"Allowed distance/time delta between user sign-ins."},{"field":"MFABypassIndicators","description":"Signals of repeated or anomalous MFA failures linked to phishing campaigns."}],"log_sources":[{"component_id":"DC0067","component":"Logon Session Creation","name":"azure:signinlogs","channel":"Failed MFA attempts, unusual conditional access triggers, login attempts from unexpected IP ranges","platforms":["Identity Provider"],"analytic_id":"AN0192","source_url":"https://attack.mitre.org/detectionstrategies/DET0070#AN0192","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"}]},{"id":"AN0193","name":"Analytic 0193","guidance":"Phishing delivered via SaaS services (chat, collaboration platforms) where messages contain malicious URLs or attachments. Detect anomalous link clicks, suspicious file uploads, or token misuse after SaaS-based phishing attempts.","url":"https://attack.mitre.org/detectionstrategies/DET0070#AN0193","platforms":["SaaS"],"tuning":[{"field":"MonitoredSaaSApps","description":"Scope of SaaS platforms under phishing monitoring."},{"field":"LinkInspectionPolicy","description":"Threshold for auto-expansion and detonation of URLs sent in SaaS messages."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"saas:collaboration","channel":"MessagePosted: Suspicious links or attachment delivery via collaboration tools (Slack, Teams, Zoom)","platforms":["SaaS"],"analytic_id":"AN0193","source_url":"https://attack.mitre.org/detectionstrategies/DET0070#AN0193","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0067","name":"Logon Session Creation","tag":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0009","name":"Hikit","url":"https://attack.mitre.org/software/S0009","kind":"malware","description":"[Hikit](https://attack.mitre.org/software/S0009) has been spread through spear phishing.(Citation: Novetta-Axiom)","relationship_id":"relationship--0866161a-0753-44ab-bb14-a977654ddc68","references":[{"source_name":"Novetta-Axiom","description":"Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}]},{"id":"S1073","name":"Royal","url":"https://attack.mitre.org/software/S1073","kind":"malware","description":"[Royal](https://attack.mitre.org/software/S1073) has been spread through the use of phishing campaigns including \"call back phishing\" where victims are lured into calling a number provided through email.(Citation: Cybereason Royal December 2022)(Citation: Kroll Royal Deep Dive February 2023)(Citation: CISA Royal AA23-061A March 2023)","relationship_id":"relationship--eb4bcd20-8bd2-4dd2-bbac-f784058ee9dc","references":[{"source_name":"CISA Royal AA23-061A March 2023","description":"CISA. (2023, March 2). #StopRansomware: Royal Ransomware. Retrieved March 31, 2023.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a"},{"source_name":"Cybereason Royal December 2022","description":"Cybereason Global SOC and Cybereason Security Research Teams. (2022, December 14). Royal Rumble: Analysis of Royal Ransomware. Retrieved March 30, 2023.","url":"https://www.cybereason.com/blog/royal-ransomware-analysis"},{"source_name":"Kroll Royal Deep Dive February 2023","description":"Iacono, L. and Green, S. (2023, February 13). Royal Ransomware Deep Dive. Retrieved March 30, 2023.","url":"https://www.kroll.com/en/insights/publications/cyber/royal-ransomware-deep-dive"}]},{"id":"S1139","name":"INC Ransomware","url":"https://attack.mitre.org/software/S1139","kind":"malware","description":"[INC Ransomware](https://attack.mitre.org/software/S1139) campaigns have used spearphishing emails for initial access.(Citation: SentinelOne INC Ransomware)","relationship_id":"relationship--1787ebc1-29a3-4d93-ba24-baf11a4a7d19","references":[{"source_name":"SentinelOne INC Ransomware","description":"SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024.","url":"https://www.sentinelone.com/anthology/inc-ransom/"}]}],"actors":[{"id":"G0001","name":"Axiom","url":"https://attack.mitre.org/groups/G0001","kind":"intrusion-set","description":"[Axiom](https://attack.mitre.org/groups/G0001) has used spear phishing to initially compromise victims.(Citation: Cisco Group 72)(Citation: Novetta-Axiom)","relationship_id":"relationship--d738cc0a-6d6f-41d9-88d0-9fe83bacad55","references":[{"source_name":"Cisco Group 72","description":"Esler, J., Lee, M., and Williams, C. (2014, October 14). Threat Spotlight: Group 72. Retrieved January 14, 2016.","url":"http://blogs.cisco.com/security/talos/threat-spotlight-group-72"},{"source_name":"Novetta-Axiom","description":"Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}]},{"id":"G0069","name":"MuddyWater","url":"https://attack.mitre.org/groups/G0069","kind":"intrusion-set","description":"[MuddyWater](https://attack.mitre.org/groups/G0069) has sent phishing emails to targets from the email address support@microsoftonlines[.]com.(Citation: NaumaanProofpoint_GlobalClickFix_April2025)","relationship_id":"relationship--895309ee-7a67-4ea6-be96-35fd2e9bffc1","references":[{"source_name":"NaumaanProofpoint_GlobalClickFix_April2025","description":"Naumaan, S., et al. (2025, April 17). Around the World in 90 Days: State-Sponsored Actors Try ClickFix . Retrieved January 21, 2026.","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has used spearphishing to gain initial access and intelligence.(Citation: MSFT-AI)(Citation: Mandiant APT43 March 2024)","relationship_id":"relationship--09a59267-dab8-4bd3-b1e5-d5ab9cb1853a","references":[{"source_name":"Mandiant APT43 March 2024","description":"Mandiant. (2024, March 14). APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations. Retrieved May 3, 2024.","url":"https://services.google.com/fh/files/misc/apt43-report-en.pdf"},{"source_name":"MSFT-AI","description":"Microsoft Threat Intelligence. (2024, February 14). Staying ahead of threat actors in the age of AI. Retrieved March 11, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/"}]},{"id":"G0115","name":"GOLD SOUTHFIELD","url":"https://attack.mitre.org/groups/G0115","kind":"intrusion-set","description":"[GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) has conducted malicious spam (malspam) campaigns to gain access to victim's machines.(Citation: Secureworks REvil September 2019)","relationship_id":"relationship--f7aab529-962c-4bb8-812b-d63e0f8df494","references":[{"source_name":"Secureworks REvil September 2019","description":"Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"}]},{"id":"G1032","name":"INC Ransom","url":"https://attack.mitre.org/groups/G1032","kind":"intrusion-set","description":"[INC Ransom](https://attack.mitre.org/groups/G1032) has used phishing to gain initial access.(Citation: SOCRadar INC Ransom January 2024)(Citation: SentinelOne INC Ransomware)\n","relationship_id":"relationship--1ee6640f-978b-4402-a6a7-c74e7c8e1c4b","references":[{"source_name":"SentinelOne INC Ransomware","description":"SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024.","url":"https://www.sentinelone.com/anthology/inc-ransom/"},{"source_name":"SOCRadar INC Ransom January 2024","description":"SOCRadar. (2024, January 24). Dark Web Profile: INC Ransom. Retrieved June 5, 2024.","url":"https://socradar.io/dark-web-profile-inc-ransom/"}]},{"id":"G1041","name":"Sea Turtle","url":"https://attack.mitre.org/groups/G1041","kind":"intrusion-set","description":"[Sea Turtle](https://attack.mitre.org/groups/G1041) used spear phishing to gain initial access to victims.(Citation: Talos Sea Turtle 2019)","relationship_id":"relationship--a9860318-23fa-4a76-bbe4-b3f7ccd7b9c5","references":[{"source_name":"Talos Sea Turtle 2019","description":"Cisco Talos. (2019, April 17). Sea Turtle: DNS Hijacking Abuses Trust In Core Internet Service. Retrieved November 20, 2024.","url":"https://blog.talosintelligence.com/seaturtle/"}]},{"id":"G1049","name":"AppleJeus","url":"https://attack.mitre.org/groups/G1049","kind":"intrusion-set","description":"[AppleJeus](https://attack.mitre.org/groups/G1049) has used spearphishing emails to distribute malicious payloads.(Citation: dtex DPRK 2025 structure ITworkers)","relationship_id":"relationship--dbaed920-c55d-4762-8279-91aac835bbfc","references":[{"source_name":"dtex DPRK 2025 structure ITworkers","description":"Michael “Barni” Barnhart, DTEX, and Anonymous SMEs. (2025, May 14). Exposing DPRK's Cyber Syndicate and Hidden IT Workforce. Retrieved September 3, 2025.","url":"https://reports.dtexsystems.com/DTEX-Exposing+DPRK+Cyber+Syndicate+and+Hidden+IT+Workforce.pdf"}]},{"id":"G1055","name":"VOID MANTICORE","url":"https://attack.mitre.org/groups/G1055","kind":"intrusion-set","description":"[VOID MANTICORE](https://attack.mitre.org/groups/G1055) has emailed victims threatening messages.(Citation: DOJ FBI Handala Hack March 2026) [VOID MANTICORE](https://attack.mitre.org/groups/G1055) has used phishing as an initial access vector.(Citation: Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026)","relationship_id":"relationship--18f5dc98-f6fd-489a-ab3e-93f3c613e82e","references":[{"source_name":"DOJ FBI Handala Hack March 2026","description":"DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.","url":"https://www.justice.gov/opa/media/1431956/dl?inline"},{"source_name":"Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026","description":"DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.","url":"https://dti.domaintools.com/research/handala-mois-linked-cyber-influence-ecosystem-threat-intelligence-assessment"}]}],"mitigations":[{"id":"M1017","name":"User Training","url":"https://attack.mitre.org/mitigations/M1017","kind":"course-of-action","description":"Users can be trained to identify social engineering techniques and phishing emails.","relationship_id":"relationship--ee935350-f68f-4bd7-bfca-878ae48a2b97","references":[]},{"id":"M1021","name":"Restrict Web-Based Content","url":"https://attack.mitre.org/mitigations/M1021","kind":"course-of-action","description":"Determine if certain websites or attachment types (ex: .scr, .exe, .pif, .cpl, etc.) that can be used for phishing are necessary for business operations and consider blocking access if activity cannot be monitored well or if it poses a significant risk.","relationship_id":"relationship--a205b0ce-df00-40ae-b626-7dc3e8146d45","references":[]},{"id":"M1031","name":"Network Intrusion Prevention","url":"https://attack.mitre.org/mitigations/M1031","kind":"course-of-action","description":"Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity.","relationship_id":"relationship--76588f90-79b8-4a61-ae07-3321393e5707","references":[]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.","relationship_id":"relationship--12fc907f-4ed1-4d44-a40b-12bfa8b89082","references":[]},{"id":"M1049","name":"Antivirus/Antimalware","url":"https://attack.mitre.org/mitigations/M1049","kind":"course-of-action","description":"Anti-virus can automatically quarantine suspicious files.","relationship_id":"relationship--ed821f5e-9527-4fbb-ae76-37a79592dfb6","references":[]},{"id":"M1054","name":"Software Configuration","url":"https://attack.mitre.org/mitigations/M1054","kind":"course-of-action","description":"Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing)","relationship_id":"relationship--7b090d29-d49d-4967-9843-90636bfb039f","references":[{"source_name":"ACSC Email Spoofing","description":"Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20210708014107/https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf"},{"source_name":"Microsoft Anti Spoofing","description":"Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.","url":"https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1564.008":"/ttp-simulation/techniques/enterprise/T1564.008/","T1684.002":"/ttp-simulation/techniques/enterprise/T1684.002/","T1204":"/ttp-simulation/techniques/enterprise/T1204/","T1566":"/ttp-simulation/techniques/enterprise/T1566/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1566","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}