← Back to Explore
T1534
Internal Spearphishing
After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is initially compromised either by controlling the user's device or by compromising the account credentials of the user. Adversaries may then attempt to take advantage of the trusted internal account to incr...
LinuxmacOSOffice SuiteSaaSWindows
300
Detections
2
Sources
7
Threat Actors
BY SOURCE
299sublime1elastic
PROCEDURES (67)
Impersonat23 detections
Auto-extracted: 23 detections for impersonat
Email Security22 detections
Auto-extracted: 22 detections for email security
Email20 detections
Auto-extracted: 20 detections for email
Service18 detections
Auto-extracted: 18 detections for service
General Monitoring18 detections
Auto-extracted: 18 detections for general monitoring
Attachment15 detections
Auto-extracted: 15 detections for attachment
Impersonat13 detections
Auto-extracted: 13 detections for impersonat
Suspicious12 detections
Auto-extracted: 12 detections for suspicious
Network Connection Monitoring12 detections
Auto-extracted: 12 detections for network connection monitoring
Authentication Monitoring9 detections
Auto-extracted: 9 detections for authentication monitoring
Email9 detections
Auto-extracted: 9 detections for email
Attachment8 detections
Auto-extracted: 8 detections for attachment
Phish7 detections
Auto-extracted: 7 detections for phish
Credential7 detections
Auto-extracted: 7 detections for credential
Suspicious6 detections
Auto-extracted: 6 detections for suspicious
Impersonat5 detections
Auto-extracted: 5 detections for impersonat
Credential5 detections
Auto-extracted: 5 detections for credential
Office4 detections
Auto-extracted: 4 detections for office
Service4 detections
Auto-extracted: 4 detections for service
Suspicious4 detections
Auto-extracted: 4 detections for suspicious
Bypass4 detections
Auto-extracted: 4 detections for bypass
Cloud3 detections
Auto-extracted: 3 detections for cloud
Attachment3 detections
Auto-extracted: 3 detections for attachment
Attachment3 detections
Auto-extracted: 3 detections for attachment
Remote3 detections
Auto-extracted: 3 detections for remote
Phish3 detections
Auto-extracted: 3 detections for phish
Aws3 detections
Auto-extracted: 3 detections for aws
Script Execution Monitoring3 detections
Auto-extracted: 3 detections for script execution monitoring
Attachment3 detections
Auto-extracted: 3 detections for attachment
Service3 detections
Auto-extracted: 3 detections for service
Service2 detections
Auto-extracted: 2 detections for service
Impersonat2 detections
Auto-extracted: 2 detections for impersonat
Api2 detections
Auto-extracted: 2 detections for api
Service2 detections
Auto-extracted: 2 detections for service
Credential2 detections
Auto-extracted: 2 detections for credential
Office2 detections
Auto-extracted: 2 detections for office
Email2 detections
Auto-extracted: 2 detections for email
Phish2 detections
Auto-extracted: 2 detections for phish
Evasion2 detections
Auto-extracted: 2 detections for evasion
Unusual2 detections
Auto-extracted: 2 detections for unusual
Macro2 detections
Auto-extracted: 2 detections for macro
Phish1 detections
Auto-extracted: 1 detections for phish
Service1 detections
Auto-extracted: 1 detections for service
Cloud1 detections
Auto-extracted: 1 detections for cloud
Http1 detections
Auto-extracted: 1 detections for http
Service1 detections
Auto-extracted: 1 detections for service
Encrypt1 detections
Auto-extracted: 1 detections for encrypt
Api1 detections
Auto-extracted: 1 detections for api
Bypass1 detections
Auto-extracted: 1 detections for bypass
Credential1 detections
Auto-extracted: 1 detections for credential
Unusual1 detections
Auto-extracted: 1 detections for unusual
Encrypt1 detections
Auto-extracted: 1 detections for encrypt
Suspicious1 detections
Auto-extracted: 1 detections for suspicious
Service Monitoring1 detections
Auto-extracted: 1 detections for service monitoring
Bypass1 detections
Auto-extracted: 1 detections for bypass
Cloud1 detections
Auto-extracted: 1 detections for cloud
Http1 detections
Auto-extracted: 1 detections for http
Unusual1 detections
Auto-extracted: 1 detections for unusual
Impersonat1 detections
Auto-extracted: 1 detections for impersonat
Suspicious1 detections
Auto-extracted: 1 detections for suspicious
Office1 detections
Auto-extracted: 1 detections for office
Remote1 detections
Auto-extracted: 1 detections for remote
Http1 detections
Auto-extracted: 1 detections for http
Evasion1 detections
Auto-extracted: 1 detections for evasion
Unusual1 detections
Auto-extracted: 1 detections for unusual
Attachment1 detections
Auto-extracted: 1 detections for attachment
Office1 detections
Auto-extracted: 1 detections for office
DETECTIONS (300)
Advance Fee Fraud (AFF) from freemail provider or suspicious TLD
sublimemedium
AnonymousFox indicators
sublimehigh
Attachment with VBA macros from employee impersonation (unsolicited)
sublimehigh
Attachment: Calendar file with invisible Unicode characters
sublimehigh
Attachment: Calendar invite with Google redirect and invoice request
sublimemedium
Attachment: Canva PDF with susupicious author metadata
sublimehigh
Attachment: Credit card application with WhatsApp contact
sublimemedium
Attachment: Duplicated header pages in fraudulent multi-page PDF Request for Quotation
sublimemedium
Attachment: Embedded MSG file with payment lure and newly registered domain
sublimemedium
Attachment: EML with Sharepoint link likely unrelated to sender
sublimemedium
Attachment: Encrypted zip file with payment-related lure
sublimemedium
Attachment: Excel file with hyperlinks to suspicious domains
sublimemedium
Attachment: Fake lawyer & sports agent identities
sublimehigh
Attachment: Fake research internship offer
sublimemedium
Attachment: Fictitious invoice using LinkedIn's address
sublimemedium
Attachment: Hex-encoded recipient email in URL fragment
sublimemedium
Attachment: ICS calendar file with legal language
sublimemedium
Attachment: ICS calendar file with real estate fraud link
sublimemedium
Attachment: ICS calendar file with suspicious UID domain
sublimemedium
Attachment: ICS calendar invite with BEC intent
sublimemedium
Attachment: ICS calendar invite with bid/RFP lure and suspicious link
sublimemedium
Attachment: ICS calendar invite with financial lure and suspicious link
sublimemedium
Attachment: ICS file with meeting prefix
sublimehigh
Attachment: ICS with employee policy review lure
sublimehigh
Attachment: Invoice and W-9 PDFs with suspicious creators
sublimehigh
Attachment: Legal themed message or PDF with suspicious indicators
sublimemedium
Attachment: Link to Doubleclick.net open redirect
sublimemedium
Attachment: Meetergo booking link
sublimemedium
Attachment: Oversized guest-list calendar invite with purchase order lure
sublimemedium
Attachment: Oversized guest-list calendar invite with voicemail lure
sublimemedium
Attachment: PDF bid/proposal lure with credential theft indicators
sublimemedium
Attachment: PDF contains W9 or invoice YARA signatures
sublimemedium
Attachment: PDF file with link to fake Bitcoin exchange
sublimelow
Attachment: PDF file with recipient domain and ATT eCheckRun pattern
sublimemedium
Attachment: PDF generated with wkhtmltopdf tool and default title
sublimelow
Attachment: PDF Object Hash associated with a fake invoice and a W-9
sublimehigh
Attachment: PDF RFP lure
sublimemedium
Attachment: PDF W9 signature reuse
sublimemedium
Attachment: PDF with dub.sh shortened link
sublimemedium
Attachment: PDF with fake invoice using suspicious font sizing
sublimemedium
Attachment: PDF with self-service platform links with self sender or blank recipients
sublimemedium
Attachment: PDF with specific W-9 lure
sublimemedium
Attachment: PDF with suspicious internal object reference identifier
sublimemedium
Attachment: PDF with version-only producer and default metadata
sublimemedium
Attachment: PDF with W-9 form indicators
sublimehigh
Attachment: QuickBooks PDF lure
sublimemedium
Attachment: RFP/RFQ impersonating government entities
sublimehigh
Attachment: Romance scam with image lure and advance-fee or suspicious link indicators
sublimemedium
Attachment: Suspicious use of Unicode tag characters in ICS File
sublimemedium
Attachment: USDA bid invitation impersonation
sublimemedium
Attachment: Word document with hyperlink and fraud language
sublimehigh
Attachment: XLS with legal confidentiality disclaimer
sublimemedium
AWS SNS Topic Message Publish by Rare User
elastichigh
BEC with unusual reply-to or return-path mismatch
sublimehigh
BEC: Employee impersonation with subject manipulation
sublimehigh
BEC: Executive coaching vendor impersonation
sublimemedium
BEC: Financial fraud from newly registered sender domain
sublimemedium
BEC: Tax document request
sublimemedium
BEC: Wealth management lure from newly registered domain
sublimemedium
BEC/Fraud: B2B sales inquiry cold outreach lure
sublimemedium
BEC/Fraud: Contract or order lure with mismatched reply-to
sublimemedium
BEC/Fraud: Fake investment outreach from suspicious TLD
sublimemedium
BEC/Fraud: Generic scam attempt to undisclosed recipients
sublimelow
BEC/Fraud: Job scam fake thread or plaintext pivot to freemail
sublimemedium
BEC/Fraud: Penpal scam
sublimemedium
BEC/Fraud: Reply-chain manipulation with urgent keywords and self-reply
sublimemedium
BEC/Fraud: Romance scam
sublimemedium
BEC/Fraud: Scam lure with freemail pivot
sublimelow
BEC/Fraud: Self-addressed reply with unrelated link in ongoing thread
sublimemedium
BEC/Fraud: Student loan callback phishing
sublimemedium
BEC/Fraud: Unsolicited business acquisition offer
sublimemedium
BEC/Fraud: Urgent language and suspicious sending/infrastructure patterns
sublimemedium
Benefits enrollment impersonation
sublimehigh
Body: AI-generated invoice template artifacts
sublimemedium
Body: Bid solicitation PDF lure
sublimemedium
Body: Embedded email headers indicative of thread hijacking/abuse
sublimemedium
Body: Invisible Unicode obfuscation student loan callback phishing
sublimemedium
Body: PayApp transaction reference pattern
sublimemedium
Body: Yellow highlighted text markers
sublimelow
Brand impersonation: AARP
sublimemedium
Brand impersonation: Anthropic/Claude with newly registered domain
sublimemedium
Brand impersonation: Aquent
sublimemedium
Brand impersonation: Aramco
sublimemedium
Brand impersonation: AuthentiSign
sublimemedium
Brand impersonation: Canada Revenue Agency
sublimemedium
Brand impersonation: Deloitte LLC domain in CC
sublimehigh
Brand impersonation: Enbridge
sublimemedium
Brand impersonation: Fake procurement/RFQ PDF from energy and industrial companies
sublimehigh
Brand impersonation: Google Authenticator
sublimemedium
Brand impersonation: Interac
sublimemedium
Brand impersonation: Internal Revenue Service
sublimehigh
Brand impersonation: Kroger
sublimemedium
Brand impersonation: Mailgun
sublimemedium
Brand impersonation: McAfee
sublimemedium
Brand impersonation: MetaMask
sublimehigh
Brand impersonation: Microsoft logo or suspicious language with open redirect
sublimehigh
Brand Impersonation: Procore
sublimemedium
Brand impersonation: Purdue ePlanroom with suspicious links
sublimemedium
Brand impersonation: QuickBooks dispute notification
sublimehigh
Brand impersonation: QuickBooks notification from Intuit themed company name
sublimemedium
Brand impersonation: Robert Half
sublimemedium
Brand impersonation: Sedgwick Claims
sublimemedium
Brand impersonation: SendGrid
sublimemedium
Brand impersonation: Social Security Administration
sublimemedium
Brand impersonation: Trust Wallet
sublimehigh
Brand impersonation: UK government Home Office
sublimehigh
Brand impersonation: United States Patent and Trademark Office
sublimemedium
Brand impersonation: Vanguard
sublimemedium
Brand impersonation: WeTransfer
sublimehigh
Business Email Compromise (BEC) attempt from unsolicited sender
sublimemedium
Business Email Compromise (BEC) attempt from untrusted sender
sublimemedium
Business Email Compromise (BEC) attempt from untrusted sender (French/Français)
sublimemedium
Business Email Compromise (BEC) attempt with masked recipients and reply-to mismatch (unsolicited)
sublimemedium
Business Email Compromise (BEC) with request for mobile number
sublimemedium
Business Email Compromise: Request for mobile number via reply thread hijacking
sublimemedium
Callback phishing via Zelle Service Abuse
sublimemedium
Callback phishing: SumUp infrastructure abuse
sublimehigh
Canva infrastructure abuse
sublimemedium
COVID-19 themed fraud with sender and reply-to mismatch or compensation award
sublimemedium
Credential Phishing: Bitcoin portfolio confirmation
sublimemedium
Credential phishing: Generic document share with unicode and proceedural greeting template
sublimelow
Credential phishing: Generic document sharing
sublimemedium
Credential phishing: Personalized document signing request
sublimemedium
Credential phishing: Tax form impersonation with payment request
sublimemedium
Display Name Emoji with Financial Symbols
sublimelow
DocuSign impersonation via CloudHQ links
sublimemedium
Employee impersonation with urgent request (untrusted sender)
sublimemedium
Employee impersonation: Payroll fraud
sublimehigh
Encrypted Microsoft Office files from untrusted sender
sublimemedium
Evasion: Suspicious use of Unicode tag characters
sublimemedium
Evasion: Variation selectors in subject line
sublimemedium
Extortion / Sextortion - PDF attachment leveraging breach data from freemail sender
sublimehigh
Fake message thread - Untrusted sender with a mismatched freemail reply-to address
sublimemedium
Fake request for tax preparation
sublimehigh
Fake thread with suspicious indicators
sublimemedium
Fake warning banner using confusable characters
sublimemedium
File sharing link with a suspicious subject
sublimemedium
Fraudulent e-commerce operators
sublimehigh
Fraudulent order confirmation/shipping notification from Chinese sender domain
sublimemedium
Free email provider sender with mismatched provider reply-to
sublimemedium
Generic service abuse from newly registered domain
sublimehigh
Google share notification with suspicious comments
sublimehigh
Headers: Fake in-reply-to with wildcard sender and missing thread context
sublimehigh
Headers: Invalid recipient domain with mismatched reply-to from new sender
sublimemedium
Headers: iOS/iPadOS mailer with invalid build number
sublimemedium
Headers: Outlook Express mailer
sublimemedium
Headers: System account impersonation with empty sender address
sublimemedium
Headers: X-Source-Auth mismatch with mismatched reply-to domain
sublimehigh
Honorific greeting BEC attempt with sender and reply-to mismatch
sublimelow
HR impersonation via e-sign agreement comment
sublimehigh
HTML: Bidirectional (BIDI) HTML override with right to left obfuscation
sublimemedium
HTML: Template placeholders or recipient email in element class attributes
sublimehigh
Impersonation: Australian Federal Police with criminal case language
sublimehigh
Impersonation: Employee name in subject with suspicious sender
sublimemedium
Impersonation: Employee using fabricated identity in initial contact
sublimehigh
Impersonation: Executive using numbered local part
sublimehigh
Impersonation: Fake product discount promotion
sublimemedium
Impersonation: Human Resources with link or attachment and engaging language
sublimemedium
Impersonation: Internal corporate services
sublimehigh
Impersonation: IT Department mailbox storage alert
sublimemedium
Impersonation: Legal firm with copyright infringement notice
sublimemedium
Impersonation: SAM/SBA federal registration
sublimehigh
Impersonation: Suspected supplier impersonation with suspicious content
sublimehigh
Investor solicitation with organization targeting
sublimemedium
Job scam (unsolicited sender)
sublimelow
Job scam with specific salary pattern
sublimelow
Link abuse: Self-service creation platform link with suspicious recipient behavior
sublimehigh
Link: Apple App Store malicious ad manager themed apps from free email provider
sublimemedium
Link: BEC with newly registered domains and financial keywords
sublimemedium
Link: Breely link masquerading as PDF
sublimehigh
Link: Compromised WordPress site redirecting to suspicious root domain
sublimehigh
Link: Cryptocurrency fraud with suspicious links
sublimehigh
Link: Display text is 'unsb'
sublimelow
Link: Display text matches subject line
sublimemedium
Link: Fake forwarded message with suspicious URL in plain text
sublimemedium
Link: Fake RFP/bid reference number lure
sublimemedium
Link: File sharing impersonation with suspicious language and sending patterns
sublimemedium
Link: Generic financial document with proceedural timeline template
sublimemedium
Link: Giveaway lure with amsweb.php redirect path
sublimemedium
Link: Gmail confidential mode message with job scam subject
sublimemedium
Link: Google Drawings link from new sender
sublimemedium
Link: Hotel booking spoofed display URL
sublimemedium
Link: HR impersonation with suspicious domain indicators and credential theft
sublimehigh
Link: Invalid reply-to with recipient details in subject, body, and encoded link
sublimemedium
Link: Invoice or receipt from freemail sender with customer service number
sublimelow
Link: Malformed subdomain ending in hyphen
sublimelow
Link: Mismatched free file host links with document lure
sublimemedium
Link: Monday hosted link with suspicious content
sublimemedium
Link: Newly registered domain in reference lure
sublimemedium
Link: Recently registered .vu domain in lure
sublimelow
Link: Remittance payment request with timeline template
sublimemedium
Link: RFI document reference pattern in display text
sublimemedium
Link: Self-sent message with quarterly document review request
sublimecritical
Link: Self-sent PDF lure with subject correlation
sublimemedium
Link: SharePoint filename matches org name
sublimemedium
Link: Shortened URL with fragment matching subject
sublimemedium
Link: Tax document lure Portuguese/Spanish with suspicious domains
sublimemedium
Link: URL scheme obfuscation via split HTML anchors
sublimehigh
Link: WordPress login page with Blogspot Binance scam
sublimemedium
Lookalike sender domain (untrusted sender)
sublimehigh