T1566.002 Spearphishing Link — Detection Rules

Detection workspace for T1566.002 Spearphishing Link: 3 Sigma sources, 1 Atlas concepts and 0 anomaly models. No live detection validation.

Source-backed rule directory

Potential Malicious Usage of CloudTrail System Manager · test · high · {"product":"aws","service":"cloudtrail"}
Suspicious Email Delivered In Microsoft 365 · experimental · medium · {"service":"audit","product":"m365"}
Suspicious Execution via macOS Script Editor · test · medium · {"category":"process_creation","product":"macos"}

Atlas deterministic concepts

T1566.002 Spearphishing Link

MATCH(message_url IN denylist OR url_category = malicious) -> ALERT

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0107 Detection Strategy for Spearphishing Links

AN0298 Analytic 0298

Correlation of inbound emails with embedded links followed by user-driven browser navigation to suspicious or obfuscated domains. Detection chain includes malicious URL in email → user click recorded in Office logs → browser process spawning unusual child processes (e.g., PowerShell, cmd) or download activity.

AN0299 Analytic 0299

Detection of spearphishing links through mail logs and browser activity. Behavior includes email with suspicious URLs → user click recorded in mail/web proxy logs → shell or interpreter launched from browser process.

AN0300 Analytic 0300

Correlation of Mail.app logs with Safari/Chrome activity. Suspicious behavior includes email links → Safari/Chrome accessing newly registered or lookalike domains → osascript or Terminal spawned unexpectedly.

AN0301 Analytic 0301

Detection of OAuth consent phishing or malicious login attempts initiated through spearphishing links. Behavior chain includes inbound email with OAuth URL → consent page visited → unusual token grants logged in IdP logs.

Connected ecosystem references

Linked tags

rule_source_available

Simulation, tools and telemetry

T1566.002 simulation workspace

AADInternals · S0677

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing anomaly research

Original publication snapshot · Anomaly Detection Atlas

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.