1200KM / detection
T0865 Spearphishing Attachment — Detection Rules
Detection workspace for T0865 Spearphishing Attachment: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0781 Detection of Spearphishing Attachment
AN1913 Analytic 1913
Real-time monitoring identifies an email client process on an Industrial Control System (ICS) Linux workstation spawning a child process inconsistent with normal email handling. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
AN2241 Analytic 2241
Real-time monitoring identifies an Industrial Control System (ICS) field device or embedded engineering terminal receiving malformed or exploit-payload data via its built-in communication interface from an external source, designed to exploit a vulnerability in the device's communication stack. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
AN2277 Analytic 2277
Real-time monitoring identifies an email client or Office application process spawning a script interpreter or shell process on an Industrial Control System (ICS) engineering or operator workstation, immediately following the opening of an email attachment. Documented across multiple ICS incident reports as a primary initial access vector. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
No reviewed association in this snapshot.
Existing anomaly research
Complete technique engineering workbook
Collection configuration and event examples · Anomaly models and design worksheet · Tools and documented software · Simulation procedures · Offline synthetic collection check
Exact source tags are not semantic relevance verdicts. Review actual rule conditions and observation points; imported rules are not backend-compiled or live-validated.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.