EXPLORE
← Back to Explore
T1598

Phishing for Information

Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from [Phishing](https://attack.mitre.org/techniques/T1566) in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engi...

PRE
1205
Detections
2
Sources
6
Threat Actors

BY SOURCE

1204sublime1splunk_escu

PROCEDURES (122)

Authentication Monitoring101 detections

Auto-extracted: 101 detections for authentication monitoring

General Monitoring53 detections

Auto-extracted: 53 detections for general monitoring

Impersonat49 detections

Auto-extracted: 49 detections for impersonat

Email Security44 detections

Auto-extracted: 44 detections for email security

Impersonat39 detections

Auto-extracted: 39 detections for impersonat

Email38 detections

Auto-extracted: 38 detections for email

Attachment37 detections

Auto-extracted: 37 detections for attachment

Phish33 detections

Auto-extracted: 33 detections for phish

Phish32 detections

Auto-extracted: 32 detections for phish

Suspicious31 detections

Auto-extracted: 31 detections for suspicious

Service28 detections

Auto-extracted: 28 detections for service

Suspicious25 detections

Auto-extracted: 25 detections for suspicious

Credential22 detections

Auto-extracted: 22 detections for credential

Service22 detections

Auto-extracted: 22 detections for service

Suspicious19 detections

Auto-extracted: 19 detections for suspicious

Credential18 detections

Auto-extracted: 18 detections for credential

Suspicious16 detections

Auto-extracted: 16 detections for suspicious

Base6415 detections

Auto-extracted: 15 detections for base64

Email14 detections

Auto-extracted: 14 detections for email

Script Execution Monitoring14 detections

Auto-extracted: 14 detections for script execution monitoring

Phish14 detections

Auto-extracted: 14 detections for phish

Attachment14 detections

Auto-extracted: 14 detections for attachment

Impersonat13 detections

Auto-extracted: 13 detections for impersonat

Network Connection Monitoring13 detections

Auto-extracted: 13 detections for network connection monitoring

Phish12 detections

Auto-extracted: 12 detections for phish

Impersonat10 detections

Auto-extracted: 10 detections for impersonat

Service9 detections

Auto-extracted: 9 detections for service

Attachment9 detections

Auto-extracted: 9 detections for attachment

Bypass9 detections

Auto-extracted: 9 detections for bypass

Bypass8 detections

Auto-extracted: 8 detections for bypass

Service8 detections

Auto-extracted: 8 detections for service

Suspicious8 detections

Auto-extracted: 8 detections for suspicious

Office7 detections

Auto-extracted: 7 detections for office

Service7 detections

Auto-extracted: 7 detections for service

Obfuscat7 detections

Auto-extracted: 7 detections for obfuscat

Download7 detections

Auto-extracted: 7 detections for download

Cloud7 detections

Auto-extracted: 7 detections for cloud

Impersonat6 detections

Auto-extracted: 6 detections for impersonat

Credential6 detections

Auto-extracted: 6 detections for credential

Email6 detections

Auto-extracted: 6 detections for email

Email5 detections

Auto-extracted: 5 detections for email

Obfuscat5 detections

Auto-extracted: 5 detections for obfuscat

Api5 detections

Auto-extracted: 5 detections for api

Api5 detections

Auto-extracted: 5 detections for api

Api5 detections

Auto-extracted: 5 detections for api

Macro5 detections

Auto-extracted: 5 detections for macro

Obfuscat5 detections

Auto-extracted: 5 detections for obfuscat

Download5 detections

Auto-extracted: 5 detections for download

Encrypt4 detections

Auto-extracted: 4 detections for encrypt

Http4 detections

Auto-extracted: 4 detections for http

Base644 detections

Auto-extracted: 4 detections for base64

Credential4 detections

Auto-extracted: 4 detections for credential

Suspicious4 detections

Auto-extracted: 4 detections for suspicious

Oauth4 detections

Auto-extracted: 4 detections for oauth

Credential4 detections

Auto-extracted: 4 detections for credential

Evasion3 detections

Auto-extracted: 3 detections for evasion

Ransomware3 detections

Auto-extracted: 3 detections for ransomware

Encrypt3 detections

Auto-extracted: 3 detections for encrypt

Unusual3 detections

Auto-extracted: 3 detections for unusual

Cloud3 detections

Auto-extracted: 3 detections for cloud

Base643 detections

Auto-extracted: 3 detections for base64

Cloud3 detections

Auto-extracted: 3 detections for cloud

Beacon3 detections

Auto-extracted: 3 detections for beacon

Unusual3 detections

Auto-extracted: 3 detections for unusual

Office3 detections

Auto-extracted: 3 detections for office

Office3 detections

Auto-extracted: 3 detections for office

Token2 detections

Auto-extracted: 2 detections for token

Service2 detections

Auto-extracted: 2 detections for service

Unusual2 detections

Auto-extracted: 2 detections for unusual

Http2 detections

Auto-extracted: 2 detections for http

Attachment2 detections

Auto-extracted: 2 detections for attachment

Download2 detections

Auto-extracted: 2 detections for download

Api2 detections

Auto-extracted: 2 detections for api

Macro2 detections

Auto-extracted: 2 detections for macro

Bypass2 detections

Auto-extracted: 2 detections for bypass

Evasion2 detections

Auto-extracted: 2 detections for evasion

Inject2 detections

Auto-extracted: 2 detections for inject

Inject2 detections

Auto-extracted: 2 detections for inject

Cloud2 detections

Auto-extracted: 2 detections for cloud

Macro2 detections

Auto-extracted: 2 detections for macro

Bypass2 detections

Auto-extracted: 2 detections for bypass

Masquerad1 detections

Auto-extracted: 1 detections for masquerad

Ransomware1 detections

Auto-extracted: 1 detections for ransomware

Masquerad1 detections

Auto-extracted: 1 detections for masquerad

Bypass1 detections

Auto-extracted: 1 detections for bypass

Service1 detections

Auto-extracted: 1 detections for service

Oauth1 detections

Auto-extracted: 1 detections for oauth

Token1 detections

Auto-extracted: 1 detections for token

Attachment1 detections

Auto-extracted: 1 detections for attachment

Office1 detections

Auto-extracted: 1 detections for office

Ransomware1 detections

Auto-extracted: 1 detections for ransomware

Encrypt1 detections

Auto-extracted: 1 detections for encrypt

Office1 detections

Auto-extracted: 1 detections for office

Obfuscat1 detections

Auto-extracted: 1 detections for obfuscat

Remote1 detections

Auto-extracted: 1 detections for remote

Evasion1 detections

Auto-extracted: 1 detections for evasion

Aws1 detections

Auto-extracted: 1 detections for aws

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Masquerad1 detections

Auto-extracted: 1 detections for masquerad

Masquerad1 detections

Auto-extracted: 1 detections for masquerad

Token1 detections

Auto-extracted: 1 detections for token

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Base641 detections

Auto-extracted: 1 detections for base64

Evasion1 detections

Auto-extracted: 1 detections for evasion

Service Monitoring1 detections

Auto-extracted: 1 detections for service monitoring

Remote1 detections

Auto-extracted: 1 detections for remote

Oauth1 detections

Auto-extracted: 1 detections for oauth

Encrypt1 detections

Auto-extracted: 1 detections for encrypt

Aws1 detections

Auto-extracted: 1 detections for aws

Aws1 detections

Auto-extracted: 1 detections for aws

Impersonat1 detections

Auto-extracted: 1 detections for impersonat

Impersonat1 detections

Auto-extracted: 1 detections for impersonat

Ransomware1 detections

Auto-extracted: 1 detections for ransomware

Unusual1 detections

Auto-extracted: 1 detections for unusual

Tunnel1 detections

Auto-extracted: 1 detections for tunnel

Unusual1 detections

Auto-extracted: 1 detections for unusual

Tunnel1 detections

Auto-extracted: 1 detections for tunnel

Token1 detections

Auto-extracted: 1 detections for token

Inject1 detections

Auto-extracted: 1 detections for inject

Email1 detections

Auto-extracted: 1 detections for email

Office1 detections

Auto-extracted: 1 detections for office

Unusual1 detections

Auto-extracted: 1 detections for unusual

DETECTIONS (1205)

Abuse: Cloudflare Workers Hosted EvilTokens Domain Structure
sublimehigh
Abuse: Robinhood injected content
sublimemedium
Advance Fee Fraud (AFF) from freemail provider or suspicious TLD
sublimemedium
AnonymousFox indicators
sublimehigh
Attachment with VBA macros from employee impersonation (unsolicited)
sublimehigh
Attachment: Adobe image lure in body or attachment with suspicious link
sublimemedium
Attachment: Adobe Sign lure PDF with embedded banner images
sublimemedium
Attachment: Any HTML file within archive (unsolicited)
sublimemedium
Attachment: Archive containing HTML file with file scheme link
sublimehigh
Attachment: Calendar file with invisible Unicode characters
sublimehigh
Attachment: Calendar invite from excessive self-reply sender
sublimelow
Attachment: Calendar invite from recently registered domain
sublimehigh
Attachment: Calendar invite with Google redirect and invoice request
sublimemedium
Attachment: Callback phishing solicitation via image file
sublimehigh
Attachment: Callback phishing solicitation via pdf file
sublimehigh
Attachment: Callback phishing solicitation via text-based file
sublimemedium
Attachment: Canva PDF with susupicious author metadata
sublimehigh
Attachment: Cold outreach with invitation subject and not attachment
sublimehigh
Attachment: Compensation review lure with QR code
sublimehigh
Attachment: Compensation-themed DOCX with QR code credential theft
sublimehigh
Attachment: Credit card application with WhatsApp contact
sublimemedium
Attachment: CVE-2025-24071 - Microsoft Windows File Explorer Spoofing Vulnerability
sublimecritical
Attachment: Decoy PDF author (Julie P.)
sublimehigh
Attachment: DocuSign impersonation via PDF linking to new domain
sublimemedium
Attachment: DOCX with hyperlink targeting recipient address
sublimemedium
Attachment: DOCX with malicious document template artifacts
sublimemedium
Attachment: Double base64-encoded zip file in HTML smuggling attachment
sublimehigh
Attachment: Dropbox image lure with no Dropbox domains in links
sublimemedium
Attachment: Duplicated header pages in fraudulent multi-page PDF Request for Quotation
sublimemedium
Attachment: Embedded MSG file with payment lure and newly registered domain
sublimemedium
Attachment: EML containing a base64 encoded script
sublimehigh
Attachment: EML file contains HTML attachment with login portal indicators
sublimehigh
Attachment: EML file with HTML attachment (unsolicited)
sublimemedium
Attachment: EML file with IPFS links
sublimemedium
Attachment: EML with embedded Javascript in SVG file
sublimehigh
Attachment: EML with link to credential phishing page
sublimehigh
Attachment: EML with QR code redirecting to Cloudflare challenges
sublimelow
Attachment: EML with SharePoint files shared from GoDaddy federated tenants
sublimelow
Attachment: EML with Sharepoint link likely unrelated to sender
sublimemedium
Attachment: EML with suspicious indicators
sublimemedium
Attachment: Employment contract update with suspicious file naming
sublimehigh
Attachment: Encrypted PDF With Credential Harvesting Indicators
sublimemedium
Attachment: Encrypted PDF with credential phishing link
sublimehigh
Attachment: Encrypted PDF with credential theft body
sublimemedium
Attachment: Encrypted PDF with credential theft language in EML
sublimemedium
Attachment: Encrypted zip file with payment-related lure
sublimemedium
Attachment: Excel file with document sharing lure created by Go Excelize
sublimehigh
Attachment: Excel file with hyperlinks to suspicious domains
sublimemedium
Attachment: Excel file with suspicious template identifier
sublimehigh
Attachment: Excel Web Query File (IQY)
sublimehigh
Attachment: Fake attachment image lure
sublimemedium
Attachment: Fake email body embedded in inline image
sublimehigh
Attachment: Fake lawyer & sports agent identities
sublimehigh
Attachment: Fake mobileconfig security update profile
sublimehigh
Attachment: Fake PDF Invoices Yara
sublimemedium
Attachment: Fake research internship offer
sublimemedium
Attachment: Fake scan-to-email
sublimemedium
Attachment: Fake secure message and suspicious indicators
sublimemedium
Attachment: Fake Slack installer
sublimehigh
Attachment: Fake voicemail via PDF
sublimemedium
Attachment: Fake Zoom installer
sublimehigh
Attachment: Fictitious invoice using LinkedIn's address
sublimemedium
Attachment: Finance themed PDF with observed phishing template
sublimemedium
Attachment: Google share.google URL shortener in google.<tld>/share.google path form
sublimemedium
Attachment: GZ archive with credential theft content
sublimemedium
Attachment: Gzip-archived with nested HTML file containing image and button link
sublimehigh
Attachment: Hex-encoded recipient email in URL fragment
sublimemedium
Attachment: HTML attachment with Javascript location
sublimehigh
Attachment: HTML attachment with login portal indicators
sublimemedium
Attachment: HTML file contains exclusively Javascript
sublimemedium
Attachment: HTML file with excessive 'const' declarations and abnormally long timeouts
sublimehigh
Attachment: HTML file with excessive padding and suspicious patterns
sublimehigh
Attachment: HTML file with reference to recipient and suspicious patterns
sublimehigh
Attachment: HTML smuggling - QR Code with suspicious links
sublimehigh
Attachment: HTML smuggling 'body onload' linking to suspicious destination
sublimehigh
Attachment: HTML smuggling 'body onload' with high entropy and suspicious text
sublimehigh
Attachment: HTML smuggling Microsoft sign in
sublimehigh
Attachment: HTML smuggling with atob and high entropy
sublimehigh
Attachment: HTML smuggling with atob and high entropy via calendar invite
sublimehigh
Attachment: HTML smuggling with auto-downloaded file
sublimehigh
Attachment: HTML smuggling with base64 encoded JavaScript function
sublimehigh
Attachment: HTML smuggling with base64 encoded ZIP file
sublimemedium
Attachment: HTML smuggling with concatenation obfuscation
sublimehigh
Attachment: HTML smuggling with decimal encoding
sublimehigh
Attachment: HTML smuggling with dynamically constructed redirect URL
sublimemedium
Attachment: HTML smuggling with embedded base64 streamed file download
sublimehigh
Attachment: HTML smuggling with embedded base64-encoded ISO
sublimehigh
Attachment: HTML smuggling with eval and atob
sublimehigh
Attachment: HTML smuggling with eval and atob via calendar invite
sublimehigh
Attachment: HTML smuggling with excessive line break obfuscation
sublimehigh
Attachment: HTML smuggling with excessive string concatenation and suspicious patterns
sublimemedium
Attachment: HTML smuggling with fromCharCode and other signals
sublimehigh
Attachment: HTML smuggling with hex strings
sublimemedium
Attachment: HTML smuggling with raw array buffer
sublimehigh
Attachment: HTML smuggling with RC4 decryption
sublimehigh
Attachment: HTML smuggling with ROT13
sublimehigh
Attachment: HTML smuggling with setTimeout
sublimehigh
Attachment: HTML smuggling with unescape
sublimehigh
Attachment: HTML with emoji-to-character map
sublimehigh
Attachment: HTML with hidden body
sublimehigh
Attachment: HTML with JavaScript functions for HTTP requests
sublimehigh
Attachment: HTML with obfuscation and recipient's email in JavaScript strings
sublimehigh
Attachment: ICS calendar file with base64 encoded recipient address in URL parameters
sublimehigh
Attachment: ICS calendar file with legal language
sublimemedium
Attachment: ICS calendar file with QR code containing recipient email address
sublimehigh
Attachment: ICS calendar file with real estate fraud link
sublimemedium
Attachment: ICS calendar file with recipient address in UID field
sublimehigh
Attachment: ICS calendar file with suspicious product identifier
sublimemedium
Attachment: ICS calendar file with suspicious UID domain
sublimemedium
Attachment: ICS calendar invite hiding credential theft
sublimemedium
Attachment: ICS calendar invite with BEC intent
sublimemedium
Attachment: ICS calendar invite with bid/RFP lure and suspicious link
sublimemedium
Attachment: ICS calendar invite with financial lure and suspicious link
sublimemedium
Attachment: ICS calendar invite with Google share.google URL shortener in google.<tld>/share.google path form
sublimemedium
Attachment: ICS calendar invite with hex-encoded recipient in link
sublimemedium
Attachment: ICS calendar invite with photo/file share lure
sublimemedium
Attachment: ICS calendar with embedded file from internal sender with SPF failure
sublimehigh
Attachment: ICS calendar with suspicious link Leading to minimal JS landing page
sublimemedium
Attachment: ICS file with AWS Lambda URL
sublimemedium
Attachment: ICS file with credential theft indicators
sublimemedium
Attachment: ICS file with links to newly registered domains
sublimemedium
Attachment: ICS file with meeting prefix
sublimehigh
Attachment: ICS file with non-Gregorian calendar scale
sublimemedium
Attachment: ICS invite meeting lure
sublimemedium
Attachment: ICS link with valueless base64 query parameter
sublimemedium
Attachment: ICS voicemail lure with suspicious link
sublimemedium
Attachment: ICS with embedded Javascript in SVG file
sublimehigh
Attachment: ICS with employee policy review lure
sublimehigh
Attachment: ICS with Suspicious Office 365 app authorization (OAuth) link
sublimehigh
Attachment: Identity Confirmation With Document Unlock Code
sublimemedium
Attachment: Image-only docx/pptx callback phishing
sublimemedium
Attachment: Invoice and W-9 PDFs with suspicious creators
sublimehigh
Attachment: JPEG with gd-jpeg creator and suspicious file name
sublimehigh
Attachment: Legal themed message or PDF with suspicious indicators
sublimemedium
Attachment: Link file with UNC path
sublimemedium
Attachment: Link to Doubleclick.net open redirect
sublimemedium
Attachment: Macro files containing MHT content
sublimemedium
Attachment: Malformed mobileconfig file
sublimemedium
Attachment: Malformed OLE file
sublimehigh
Attachment: Malicious mobileconfig profile
sublimemedium
Attachment: Meetergo booking link
sublimemedium
Attachment: Microsoft 365 credential phishing
sublimehigh
Attachment: Microsoft impersonation via PDF with link and suspicious language
sublimehigh
Attachment: Microsoft OAuth credential harvesting via EML with embedded malicious links
sublimehigh
Attachment: Microsoft SharePoint Impersonation via images in macro-enabled attachment
sublimehigh
Attachment: Mobileconfig profile with mismatched embedded email
sublimemedium
Attachment: Office file contains OLE relationship to credential phishing page
sublimehigh
Attachment: Office file with credential phishing URLs
sublimemedium
Attachment: Office file with document sharing and browser instruction lures
sublimehigh
Attachment: Oversized guest-list calendar invite with purchase order lure
sublimemedium
Attachment: Oversized guest-list calendar invite with voicemail lure
sublimemedium
Attachment: Password-protected PDF with fake document indicators
sublimemedium
Attachment: PDF Adobe lure
sublimemedium
Attachment: PDF Attachment with links to workers.dev
sublimemedium
Attachment: PDF bid/proposal lure with credential theft indicators
sublimemedium
Attachment: PDF contains W9 or invoice YARA signatures
sublimemedium
Attachment: PDF credential phishing via wkhtmltopdf/Qt with suspicious link
sublimehigh
Attachment: PDF document portal credential theft lure
sublimemedium
Attachment: PDF file with link to fake Bitcoin exchange
sublimelow
Attachment: PDF file with recipient domain and ATT eCheckRun pattern
sublimemedium
Attachment: PDF generated with wkhtmltopdf tool and default title
sublimelow
Attachment: PDF Grant Payment lure with embedded link
sublimehigh
Attachment: PDF including a Microsoft lure with specific signature
sublimemedium
Attachment: PDF Link With Valueless Base64 Query Parameter
sublimemedium
Attachment: PDF Object Hash - Encrypted PDF with blue doc icon
sublimemedium
Attachment: PDF Object Hash - Generic MSFT lure
sublimemedium
Attachment: PDF Object Hash associated with fake Canada Revenue Agency documents
sublimemedium
Attachment: PDF proposal with credential theft indicators
sublimehigh
Attachment: PDF RFP lure
sublimemedium
Attachment: PDF teal SharePoint lure
sublimemedium
Attachment: PDF templated investment lure
sublimemedium
Attachment: PDF W9 signature reuse
sublimemedium
Attachment: PDF with a suspicious string and single URL
sublimehigh
Attachment: PDF with blurry lure image
sublimemedium
Attachment: PDF with bolded passcode
sublimemedium
Attachment: PDF with credential theft language and invalid reply-to domain
sublimemedium
Attachment: PDF with credential theft language and link to a free subdomain (unsolicited)
sublimemedium
Attachment: PDF with dub.sh shortened link
sublimemedium
Attachment: PDF with eCheckRun lures
sublimemedium
Attachment: PDF with embedded box-lure and javascript
sublimemedium
Attachment: PDF with EOF MD5 hash marker
sublimehigh
Attachment: PDF with fake invoice using suspicious font sizing
sublimemedium
Attachment: PDF with localhost IP in EXIF title metadata
sublimemedium
Attachment: PDF with Microsoft Purview message impersonation
sublimemedium
Attachment: PDF with multistage landing - ClickUp abuse
sublimehigh
Attachment: PDF with password in filename matching body text
sublimemedium
Attachment: PDF with personal Microsoft OneNote URL
sublimemedium
Attachment: PDF with QR code containing recipient-specific credential theft content
sublimehigh
Attachment: PDF with quote lure
sublimemedium
Attachment: PDF with recipient email in link
sublimehigh
Attachment: PDF with ReportLab library and default metadata
sublimelow
Attachment: PDF With SAI Global ISO9001 Logo
sublimehigh
Attachment: PDF with secure document acknowledgment prompt
sublimemedium
Attachment: PDF with self-service platform links with self sender or blank recipients
sublimemedium
Attachment: PDF with specific author metadata
sublimehigh
Attachment: PDF with specific blurred lure
sublimemedium
Attachment: PDF with specific W-9 lure
sublimemedium
Attachment: PDF with split QR code
sublimemedium
Attachment: PDF with suspicious document view lure
sublimemedium
Attachment: PDF with suspicious HeadlessChrome metadata
sublimemedium