T1566 Phishing — Detection Rules

Source-backed rule directory

• Potential Malicious Usage of CloudTrail System Manager · test · high · {"product":"aws","service":"cloudtrail"}
• Okta FastPass Phishing Detection · test · high · {"product":"okta","service":"okta"}
• Suspicious Execution via macOS Script Editor · test · medium · {"category":"process_creation","product":"macos"}
• Download From Suspicious TLD - Blacklist · test · low · {"category":"proxy"}
• Download From Suspicious TLD - Whitelist · test · low · {"category":"proxy"}
• Suspicious External WebDAV Execution · test · high · {"category":"proxy"}
• Potential Initial Access via DLL Search Order Hijacking · test · medium · {"product":"windows","category":"file_event"}
• HTML Help HH.EXE Suspicious Child Process · test · high · {"category":"process_creation","product":"windows"}
• Suspicious HH.EXE Execution · test · high · {"category":"process_creation","product":"windows"}
• Suspicious Microsoft OneNote Child Process · test · high · {"category":"process_creation","product":"windows"}
• Phishing Pattern ISO in Archive · test · high · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

ATT&CK analytic guidance

DET0070 Detection Strategy for Phishing across platforms.

AN0188 Analytic 0188

Unusual inbound email activity where attachments or embedded URLs are delivered to users followed by execution of new processes or suspicious document behavior. Detection involves correlating email metadata, file creation, and network activity after a phishing message is received.

AN0189 Analytic 0189

Monitor for malicious payload delivery through phishing where attachments or URLs in email clients (e.g., Thunderbird, mutt) result in unusual file creation or outbound network connections. Focus on correlation between mail logs, file writes, and execution activity.

AN0190 Analytic 0190

Detection of phishing through anomalous Mail app activity, such as attachments saved to disk and immediately executed, or Safari/Preview launching URLs and files linked from email messages. Correlate UnifiedLogs events with subsequent process execution.

AN0191 Analytic 0191

Phishing via Office documents containing embedded macros or links that spawn processes. Detection relies on correlating Office application logs with suspicious child process execution and outbound network connections.

AN0192 Analytic 0192

Phishing attempts targeting IdPs often manifest as anomalous login attempts from suspicious email invitations or fake SSO prompts. Detection correlates login flows, MFA bypass attempts, and anomalous geographic patterns following phishing email delivery.

AN0193 Analytic 0193

Phishing delivered via SaaS services (chat, collaboration platforms) where messages contain malicious URLs or attachments. Detect anomalous link clicks, suspicious file uploads, or token misuse after SaaS-based phishing attempts.