EXPLORE
← Back to Explore
T1566

Phishing

Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malic...

Identity ProviderLinuxmacOSOffice SuiteSaaSWindows
920
Detections
5
Sources
6
Threat Actors

BY SOURCE

851sublime42elastic16splunk_escu10sigma1crowdstrike_cql

PROCEDURES (143)

Authentication Monitoring97 detections

Auto-extracted: 97 detections for authentication monitoring

Email Security55 detections

Auto-extracted: 55 detections for email security

Impersonat49 detections

Auto-extracted: 49 detections for impersonat

Impersonat43 detections

Auto-extracted: 43 detections for impersonat

Credential35 detections

Auto-extracted: 35 detections for credential

Service35 detections

Auto-extracted: 35 detections for service

General Monitoring34 detections

Auto-extracted: 34 detections for general monitoring

Attachment27 detections

Auto-extracted: 27 detections for attachment

Credential26 detections

Auto-extracted: 26 detections for credential

Email24 detections

Auto-extracted: 24 detections for email

Attachment24 detections

Auto-extracted: 24 detections for attachment

Attachment23 detections

Auto-extracted: 23 detections for attachment

Network Connection Monitoring21 detections

Auto-extracted: 21 detections for network connection monitoring

Service20 detections

Auto-extracted: 20 detections for service

Phish19 detections

Auto-extracted: 19 detections for phish

Email16 detections

Auto-extracted: 16 detections for email

Suspicious15 detections

Auto-extracted: 15 detections for suspicious

Suspicious15 detections

Auto-extracted: 15 detections for suspicious

Impersonat14 detections

Auto-extracted: 14 detections for impersonat

Suspicious14 detections

Auto-extracted: 14 detections for suspicious

Credential13 detections

Auto-extracted: 13 detections for credential

Script Execution Monitoring13 detections

Auto-extracted: 13 detections for script execution monitoring

Base6411 detections

Auto-extracted: 11 detections for base64

Phish10 detections

Auto-extracted: 10 detections for phish

Suspicious8 detections

Auto-extracted: 8 detections for suspicious

Phish8 detections

Auto-extracted: 8 detections for phish

Service8 detections

Auto-extracted: 8 detections for service

Phish8 detections

Auto-extracted: 8 detections for phish

Impersonat7 detections

Auto-extracted: 7 detections for impersonat

Bypass7 detections

Auto-extracted: 7 detections for bypass

Download6 detections

Auto-extracted: 6 detections for download

Bypass6 detections

Auto-extracted: 6 detections for bypass

Unusual6 detections

Auto-extracted: 6 detections for unusual

Credential6 detections

Auto-extracted: 6 detections for credential

Obfuscat5 detections

Auto-extracted: 5 detections for obfuscat

Cloud5 detections

Auto-extracted: 5 detections for cloud

Cloud5 detections

Auto-extracted: 5 detections for cloud

Download5 detections

Auto-extracted: 5 detections for download

Attachment5 detections

Auto-extracted: 5 detections for attachment

Ransomware5 detections

Auto-extracted: 5 detections for ransomware

Base644 detections

Auto-extracted: 4 detections for base64

Api4 detections

Auto-extracted: 4 detections for api

Macro4 detections

Auto-extracted: 4 detections for macro

Credential4 detections

Auto-extracted: 4 detections for credential

Powershell4 detections

Auto-extracted: 4 detections for powershell

Download4 detections

Auto-extracted: 4 detections for download

Obfuscat3 detections

Auto-extracted: 3 detections for obfuscat

Child Process3 detections

Auto-extracted: 3 detections for child process

Service3 detections

Auto-extracted: 3 detections for service

Download3 detections

Auto-extracted: 3 detections for download

Encrypt3 detections

Auto-extracted: 3 detections for encrypt

Token3 detections

Auto-extracted: 3 detections for token

Macro3 detections

Auto-extracted: 3 detections for macro

Service3 detections

Auto-extracted: 3 detections for service

Service3 detections

Auto-extracted: 3 detections for service

Email3 detections

Auto-extracted: 3 detections for email

Http3 detections

Auto-extracted: 3 detections for http

Office3 detections

Auto-extracted: 3 detections for office

Azure2 detections

Auto-extracted: 2 detections for azure

Office2 detections

Auto-extracted: 2 detections for office

Encrypt2 detections

Auto-extracted: 2 detections for encrypt

Suspicious2 detections

Auto-extracted: 2 detections for suspicious

Obfuscat2 detections

Auto-extracted: 2 detections for obfuscat

Aws2 detections

Auto-extracted: 2 detections for aws

Child Process2 detections

Auto-extracted: 2 detections for child process

Macro2 detections

Auto-extracted: 2 detections for macro

Evasion2 detections

Auto-extracted: 2 detections for evasion

Evasion2 detections

Auto-extracted: 2 detections for evasion

Evasion2 detections

Auto-extracted: 2 detections for evasion

Oauth2 detections

Auto-extracted: 2 detections for oauth

Http2 detections

Auto-extracted: 2 detections for http

Child Process2 detections

Auto-extracted: 2 detections for child process

Dns2 detections

Auto-extracted: 2 detections for dns

Attachment2 detections

Auto-extracted: 2 detections for attachment

Exfiltrat2 detections

Auto-extracted: 2 detections for exfiltrat

Inject2 detections

Auto-extracted: 2 detections for inject

Bypass2 detections

Auto-extracted: 2 detections for bypass

Remote2 detections

Auto-extracted: 2 detections for remote

Office2 detections

Auto-extracted: 2 detections for office

Bypass2 detections

Auto-extracted: 2 detections for bypass

Persist1 detections

Auto-extracted: 1 detections for persist

Masquerad1 detections

Auto-extracted: 1 detections for masquerad

Download1 detections

Auto-extracted: 1 detections for download

Persist1 detections

Auto-extracted: 1 detections for persist

Oauth1 detections

Auto-extracted: 1 detections for oauth

Persist1 detections

Auto-extracted: 1 detections for persist

Cloud1 detections

Auto-extracted: 1 detections for cloud

Token1 detections

Auto-extracted: 1 detections for token

Persist1 detections

Auto-extracted: 1 detections for persist

Email1 detections

Auto-extracted: 1 detections for email

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Oauth1 detections

Auto-extracted: 1 detections for oauth

Unusual1 detections

Auto-extracted: 1 detections for unusual

Remote1 detections

Auto-extracted: 1 detections for remote

Encrypt1 detections

Auto-extracted: 1 detections for encrypt

Inject1 detections

Auto-extracted: 1 detections for inject

Obfuscat1 detections

Auto-extracted: 1 detections for obfuscat

Http1 detections

Auto-extracted: 1 detections for http

Aws1 detections

Auto-extracted: 1 detections for aws

Attachment1 detections

Auto-extracted: 1 detections for attachment

Office1 detections

Auto-extracted: 1 detections for office

Attachment1 detections

Auto-extracted: 1 detections for attachment

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Unusual1 detections

Auto-extracted: 1 detections for unusual

Evasion1 detections

Auto-extracted: 1 detections for evasion

Aws1 detections

Auto-extracted: 1 detections for aws

Impersonat1 detections

Auto-extracted: 1 detections for impersonat

Impersonat1 detections

Auto-extracted: 1 detections for impersonat

Impersonat1 detections

Auto-extracted: 1 detections for impersonat

Ransomware1 detections

Auto-extracted: 1 detections for ransomware

Api1 detections

Auto-extracted: 1 detections for api

Unusual1 detections

Auto-extracted: 1 detections for unusual

Command And Control1 detections

Auto-extracted: 1 detections for command and control

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Base641 detections

Auto-extracted: 1 detections for base64

Azure1 detections

Auto-extracted: 1 detections for azure

Masquerad1 detections

Auto-extracted: 1 detections for masquerad

Unusual1 detections

Auto-extracted: 1 detections for unusual

Command Line Monitoring1 detections

Auto-extracted: 1 detections for command line monitoring

Bypass1 detections

Auto-extracted: 1 detections for bypass

Child Process1 detections

Auto-extracted: 1 detections for child process

Unusual1 detections

Auto-extracted: 1 detections for unusual

Cloud Monitoring1 detections

Auto-extracted: 1 detections for cloud monitoring

Remote1 detections

Auto-extracted: 1 detections for remote

Office1 detections

Auto-extracted: 1 detections for office

Dns1 detections

Auto-extracted: 1 detections for dns

Cloud1 detections

Auto-extracted: 1 detections for cloud

Unusual1 detections

Auto-extracted: 1 detections for unusual

Oauth1 detections

Auto-extracted: 1 detections for oauth

Token1 detections

Auto-extracted: 1 detections for token

Command And Control1 detections

Auto-extracted: 1 detections for command and control

Inject1 detections

Auto-extracted: 1 detections for inject

Bypass1 detections

Auto-extracted: 1 detections for bypass

Parent Process1 detections

Auto-extracted: 1 detections for parent process

Parent Process1 detections

Auto-extracted: 1 detections for parent process

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Process Creation Monitoring1 detections

Auto-extracted: 1 detections for process creation monitoring

Api1 detections

Auto-extracted: 1 detections for api

Oauth1 detections

Auto-extracted: 1 detections for oauth

Macro1 detections

Auto-extracted: 1 detections for macro

Powershell1 detections

Auto-extracted: 1 detections for powershell

Module Load Monitoring1 detections

Auto-extracted: 1 detections for module load monitoring

Credential1 detections

Auto-extracted: 1 detections for credential

DETECTIONS (920)

Abuse: Cloudflare Workers Hosted EvilTokens Domain Structure
sublimehigh
Advance Fee Fraud (AFF) from freemail provider or suspicious TLD
sublimemedium
AnonymousFox indicators
sublimehigh
Attachment with VBA macros from employee impersonation (unsolicited)
sublimehigh
Attachment: Adobe image lure in body or attachment with suspicious link
sublimemedium
Attachment: Any HTML file within archive (unsolicited)
sublimemedium
Attachment: Archive containing HTML file with file scheme link
sublimehigh
Attachment: Calendar file with invisible Unicode characters
sublimehigh
Attachment: Calendar invite from recently registered domain
sublimehigh
Attachment: Calendar invite with Google redirect and invoice request
sublimemedium
Attachment: Calendar invite with suspicious link leading to an open redirect
sublimehigh
Attachment: Callback phishing solicitation via image file
sublimehigh
Attachment: Callback phishing solicitation via pdf file
sublimehigh
Attachment: Callback phishing solicitation via text-based file
sublimemedium
Attachment: Cold outreach with invitation subject and not attachment
sublimehigh
Attachment: Compensation review lure with QR code
sublimehigh
Attachment: Credit card application with WhatsApp contact
sublimemedium
Attachment: CVE-2025-24071 - Microsoft Windows File Explorer Spoofing Vulnerability
sublimecritical
Attachment: Decoy PDF author (Julie P.)
sublimehigh
Attachment: DocuSign impersonation via PDF linking to new domain
sublimemedium
Attachment: DOCX with hyperlink targeting recipient address
sublimemedium
Attachment: Double base64-encoded zip file in HTML smuggling attachment
sublimehigh
Attachment: Dropbox image lure with no Dropbox domains in links
sublimemedium
Attachment: EML containing a base64 encoded script
sublimehigh
Attachment: EML file contains HTML attachment with login portal indicators
sublimehigh
Attachment: EML file with HTML attachment (unsolicited)
sublimemedium
Attachment: EML file with IPFS links
sublimemedium
Attachment: EML with embedded Javascript in SVG file
sublimehigh
Attachment: EML with link to credential phishing page
sublimehigh
Attachment: EML with QR code redirecting to Cloudflare challenges
sublimelow
Attachment: EML with SharePoint files shared from GoDaddy federated tenants
sublimelow
Attachment: EML with Sharepoint link likely unrelated to sender
sublimemedium
Attachment: EML with suspicious indicators
sublimemedium
Attachment: Employment contract update with suspicious file naming
sublimehigh
Attachment: Encrypted PDF with credential theft body
sublimemedium
Attachment: Encrypted zip file with payment-related lure
sublimemedium
Attachment: Excel file with document sharing lure created by Go Excelize
sublimehigh
Attachment: Excel file with suspicious template identifier
sublimehigh
Attachment: Excel Web Query File (IQY)
sublimehigh
Attachment: Fake attachment image lure
sublimemedium
Attachment: Fake lawyer & sports agent identities
sublimehigh
Attachment: Fake scan-to-email
sublimemedium
Attachment: Fake secure message and suspicious indicators
sublimemedium
Attachment: Fake Slack installer
sublimehigh
Attachment: Fake voicemail via PDF
sublimemedium
Attachment: Fake Zoom installer
sublimehigh
Attachment: Fictitious invoice using LinkedIn's address
sublimemedium
Attachment: Finance themed PDF with observed phishing template
sublimemedium
Attachment: HTML attachment with Javascript location
sublimehigh
Attachment: HTML attachment with login portal indicators
sublimemedium
Attachment: HTML file contains exclusively Javascript
sublimemedium
Attachment: HTML file with excessive 'const' declarations and abnormally long timeouts
sublimehigh
Attachment: HTML file with excessive padding and suspicious patterns
sublimehigh
Attachment: HTML file with reference to recipient and suspicious patterns
sublimehigh
Attachment: HTML smuggling - QR Code with suspicious links
sublimehigh
Attachment: HTML smuggling 'body onload' linking to suspicious destination
sublimehigh
Attachment: HTML smuggling 'body onload' with high entropy and suspicious text
sublimehigh
Attachment: HTML smuggling Microsoft sign in
sublimehigh
Attachment: HTML smuggling with atob and high entropy
sublimehigh
Attachment: HTML smuggling with atob and high entropy via calendar invite
sublimehigh
Attachment: HTML smuggling with auto-downloaded file
sublimehigh
Attachment: HTML smuggling with base64 encoded JavaScript function
sublimehigh
Attachment: HTML smuggling with base64 encoded ZIP file
sublimemedium
Attachment: HTML smuggling with concatenation obfuscation
sublimehigh
Attachment: HTML smuggling with decimal encoding
sublimehigh
Attachment: HTML smuggling with embedded base64 streamed file download
sublimehigh
Attachment: HTML smuggling with embedded base64-encoded ISO
sublimehigh
Attachment: HTML smuggling with eval and atob
sublimehigh
Attachment: HTML smuggling with eval and atob via calendar invite
sublimehigh
Attachment: HTML smuggling with excessive line break obfuscation
sublimehigh
Attachment: HTML smuggling with excessive string concatenation and suspicious patterns
sublimemedium
Attachment: HTML smuggling with fromCharCode and other signals
sublimehigh
Attachment: HTML smuggling with hex strings
sublimemedium
Attachment: HTML smuggling with raw array buffer
sublimehigh
Attachment: HTML smuggling with RC4 decryption
sublimehigh
Attachment: HTML smuggling with ROT13
sublimehigh
Attachment: HTML smuggling with setTimeout
sublimehigh
Attachment: HTML smuggling with unescape
sublimehigh
Attachment: HTML with emoji-to-character map
sublimehigh
Attachment: HTML with hidden body
sublimehigh
Attachment: HTML with JavaScript functions for HTTP requests
sublimehigh
Attachment: HTML with obfuscation and recipient's email in JavaScript strings
sublimehigh
Attachment: ICS calendar with embedded file from internal sender with SPF failure
sublimehigh
Attachment: ICS file with AWS Lambda URL
sublimemedium
Attachment: ICS file with meeting prefix
sublimehigh
Attachment: ICS file with non-Gregorian calendar scale
sublimemedium
Attachment: ICS with embedded Javascript in SVG file
sublimehigh
Attachment: ICS with employee policy review lure
sublimehigh
Attachment: Invoice and W-9 PDFs with suspicious creators
sublimehigh
Attachment: Legal themed message or PDF with suspicious indicators
sublimemedium
Attachment: Link file with UNC path
sublimemedium
Attachment: Link to Doubleclick.net open redirect
sublimemedium
Attachment: Macro files containing MHT content
sublimemedium
Attachment: Malformed OLE file
sublimehigh
Attachment: Microsoft 365 credential phishing
sublimehigh
Attachment: Microsoft impersonation via PDF with link and suspicious language
sublimehigh
Attachment: Office file contains OLE relationship to credential phishing page
sublimehigh
Attachment: Office file with credential phishing URLs
sublimemedium
Attachment: Office file with document sharing and browser instruction lures
sublimehigh
Attachment: Password-protected PDF with fake document indicators
sublimemedium
Attachment: PDF bid/proposal lure with credential theft indicators
sublimemedium
Attachment: PDF contains W9 or invoice YARA signatures
sublimemedium
Attachment: PDF file with link to fake Bitcoin exchange
sublimelow
Attachment: PDF generated with wkhtmltopdf tool and default title
sublimelow
Attachment: PDF proposal with credential theft indicators
sublimehigh
Attachment: PDF with a suspicious string and single URL
sublimehigh
Attachment: PDF with credential theft language and invalid reply-to domain
sublimemedium
Attachment: PDF with credential theft language and link to a free subdomain (unsolicited)
sublimemedium
Attachment: PDF with Microsoft Purview message impersonation
sublimemedium
Attachment: PDF with multistage landing - ClickUp abuse
sublimehigh
Attachment: PDF with password in filename matching body text
sublimemedium
Attachment: PDF with personal Microsoft OneNote URL
sublimemedium
Attachment: PDF with recipient email in link
sublimehigh
Attachment: PDF with ReportLab library and default metadata
sublimelow
Attachment: PDF with suspicious HeadlessChrome metadata
sublimemedium
Attachment: PDF with suspicious language and redirect to suspicious file type
sublimehigh
Attachment: PDF with suspicious link and action-oriented language
sublimehigh
Attachment: QR code link with base64-encoded recipient address
sublimehigh
Attachment: QR code with credential phishing indicators
sublimemedium
Attachment: QR code with encoded recipient targeting and redirect indicators
sublimehigh
Attachment: QR code with recipient targeting and special characters
sublimehigh
Attachment: QR code with suspicious URL patterns in EML file
sublimehigh
Attachment: QR code with userinfo portion
sublimehigh
Attachment: RDP connection file
sublimemedium
Attachment: RFC822 containing suspicious file sharing language with links from untrusted sender
sublimemedium
Attachment: RFP/RFQ impersonating government entities
sublimehigh
Attachment: RTF file with suspicious link
sublimemedium
Attachment: Self-sender PDF with minimal content and view prompt
sublimehigh
Attachment: Small text file with link containing recipient email address
sublimemedium
Attachment: Soda PDF producer with encryption themes
sublimehigh
Attachment: Suspicious employee policy update document lure
sublimemedium
Attachment: Suspicious PDF created with headless browser
sublimehigh
Attachment: SVG files with evasion elements
sublimehigh
Attachment: Uncommon compressed file
sublimelow
Attachment: USDA bid invitation impersonation
sublimemedium
Attachment: Web files with suspicious comments
sublimehigh
Attachment: XLSX file with suspicious print titles metadata
sublimehigh
BEC with unusual reply-to or return-path mismatch
sublimehigh
BEC: Employee impersonation with subject manipulation
sublimehigh
BEC/Fraud: Generic scam attempt to undisclosed recipients
sublimelow
BEC/Fraud: Penpal scam
sublimemedium
BEC/Fraud: Reply-chain manipulation with urgent keywords and self-reply
sublimemedium
BEC/Fraud: Romance scam
sublimemedium
BEC/Fraud: Student loan callback phishing
sublimemedium
BEC/Fraud: Urgent language and suspicious sending/infrastructure patterns
sublimemedium
Benefits enrollment impersonation
sublimehigh
Body HTML: Comment with 24-character hex token
sublimelow
Body HTML: Recipient SLD in HTML class
sublimemedium
Body: Embedded email headers indicative of thread hijacking/abuse
sublimemedium
Body: PayApp transaction reference pattern
sublimemedium
Brand impersonation: AARP
sublimemedium
Brand impersonation: Adobe (QR code)
sublimehigh
Brand impersonation: Adobe Sign with suspicious indicators
sublimehigh
Brand impersonation: Adobe with suspicious language and link
sublimehigh
Brand impersonation: ADP
sublimemedium
Brand impersonation: AliExpress
sublimemedium
Brand impersonation: Amazon
sublimelow
Brand impersonation: Amazon Web Services (AWS)
sublimemedium
Brand impersonation: Amazon with suspicious attachment
sublimemedium
Brand impersonation: American Express (AMEX)
sublimelow
Brand impersonation: Apple
sublimehigh
Brand impersonation: Aquent
sublimemedium
Brand impersonation: Aramco
sublimemedium
Brand impersonation: AuthentiSign
sublimemedium
Brand impersonation: Bank of America
sublimehigh
Brand impersonation: Barracuda Networks
sublimemedium
Brand impersonation: Binance
sublimemedium
Brand impersonation: Blockchain[.]com
sublimemedium
Brand impersonation: Booking.com
sublimemedium
Brand impersonation: Box file sharing service
sublimemedium
Brand impersonation: Capital One
sublimehigh
Brand impersonation: Charles Schwab
sublimemedium
Brand impersonation: Chase Bank
sublimehigh
Brand impersonation: Chase bank with credential phishing indicators
sublimemedium
Brand impersonation: Coinbase
sublimehigh
Brand impersonation: Coinbase with suspicious links
sublimemedium
Brand impersonation: Dashlane
sublimemedium
Brand impersonation: DHL
sublimelow
Brand impersonation: DigitalOcean
sublimehigh
Brand impersonation: Discord notification
sublimemedium
Brand Impersonation: Disney
sublimemedium
Brand impersonation: DocSend
sublimehigh
Brand impersonation: DocuSign
sublimehigh
Brand impersonation: DocuSign (QR code)
sublimehigh
Brand impersonation: DocuSign branded attachment lure with no DocuSign links
sublimehigh
Brand impersonation: DocuSign PDF attachment with suspicious link
sublimehigh
Brand impersonation: DocuSign with embedded QR code
sublimehigh
Brand impersonation: DoorDash
sublimemedium
Brand impersonation: Dotloop
sublimemedium
Brand impersonation: Dropbox
sublimemedium
Brand impersonation: Enbridge
sublimemedium
Brand impersonation: Evite
sublimemedium
Brand impersonation: Exodus
sublimelow
Brand impersonation: Fake DocuSign HTML table not linking to DocuSign domains
sublimemedium
Brand impersonation: Fake Fax
sublimemedium
Brand impersonation: Fastway
sublimemedium
Brand impersonation: FedEx
sublimelow
Brand impersonation: File sharing notification with template artifacts
sublimelow
Brand impersonation: FINRA
sublimemedium
Brand Impersonation: Gemini Trust Company
sublimemedium