T1566.001 Spearphishing Attachment — Detection Rules

Source-backed rule directory

• Suspicious Email Delivered In Microsoft 365 · experimental · medium · {"service":"audit","product":"m365"}
• Disk Image Mounting Via Hdiutil - MacOS · test · medium · {"product":"macos","category":"process_creation"}
• ISO Image Mounted · test · medium · {"product":"windows","service":"security","definition":"The advanced audit policy setting \"Object Access > Audit Removable Storage\" must be configured for Success/Failure"}
• Password Protected ZIP File Opened (Email Attachment) · test · high · {"product":"windows","service":"security"}
• Potential Initial Access via DLL Search Order Hijacking · test · medium · {"product":"windows","category":"file_event"}
• ISO File Created Within Temp Folders · test · high · {"category":"file_event","product":"windows"}
• ISO or Image Mount Indicator in Recent Files · test · medium · {"product":"windows","category":"file_event"}
• Office Macro File Creation · test · low · {"category":"file_event","product":"windows"}
• Office Macro File Download · test · low · {"category":"file_event","product":"windows"}
• Office Macro File Creation From Suspicious Process · test · high · {"category":"file_event","product":"windows","definition":"Requirements: The \"ParentImage\" field is not available by default on EID 11 of Sysmon logs. To be able to use this rule to the full extent you need to enriche the log with additional ParentImage data"}
• Suspicious File Created in Outlook Temporary Directory · experimental · high · {"product":"windows","category":"file_event"}
• HTML Help HH.EXE Suspicious Child Process · test · high · {"category":"process_creation","product":"windows"}
• Suspicious HH.EXE Execution · test · high · {"category":"process_creation","product":"windows"}
• Suspicious HWP Sub Processes · test · high · {"category":"process_creation","product":"windows"}
• Suspicious Microsoft OneNote Child Process · test · high · {"category":"process_creation","product":"windows"}
• Suspicious Execution From Outlook Temporary Folder · test · high · {"category":"process_creation","product":"windows"}
• Arbitrary Shell Command Execution Via Settingcontent-Ms · test · medium · {"category":"process_creation","product":"windows"}
• Suspicious Double Extension File Execution · stable · high · {"category":"process_creation","product":"windows"}
• Windows Registry Trust Record Modification · test · medium · {"category":"registry_event","product":"windows"}

Atlas deterministic concepts

T1566.001 Spearphishing Attachment

MATCH(attachment_extension IN blocked_types OR attachment_hash IN denylist OR sandbox_verdict = malicious) -> ALERT

• Email Gateway Logs
• Content Inspection and Malware Scanning Logs
• Sandbox Analysis Logs
• Atlas source section

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0236 Detection Strategy for Spearphishing Attachment across OS Platforms

AN0655 Analytic 0655

Detection of spearphishing attachments by correlating suspicious email delivery with subsequent file creation and abnormal process execution (e.g., Office spawning PowerShell or CMD). Behavior chain includes inbound email metadata → attachment stored on disk → process execution → outbound network activity.

AN0656 Analytic 0656

Phishing attachments executed on Linux systems are detected by linking email logs to file creation in mail directories and subsequent suspicious process execution. Look for unexpected binaries or scripts spawned from user mail directories and anomalous outbound network activity.

AN0657 Analytic 0657

Phishing attachment detection on macOS through correlation of Mail app logs, file creation in user directories, and abnormal process execution (e.g., Preview.app or Mail.app spawning Terminal or scripting binaries). Network traffic after attachment interaction is also monitored.