Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages.
All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon the recipient populating information then returning the file.(Citation: Sophos Attachment)(Citation: GitHub Phishery) The text of the spearphishing email usually tries to give a plausible reason why the file should be filled-in, such as a request for information from a business associate. Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| PR.PS-01.01 | Configuration baselines | Mitigates | T1598.002 | Spearphishing Attachment |
Comments
This diagnostic statement provides for securely configuring production systems. This includes hardening default configurations and making security-focused setting adjustments to reduce the attack surface, enforce best practices, and protect sensitive data thereby mitigating adversary exploitation.
References
|
| PR.PS-01.02 | Least functionality | Mitigates | T1598.002 | Spearphishing Attachment |
Comments
This diagnostic statement provides for limiting unnecessary software, services, ports, protocols, etc. Ensuring systems only have installed and enabled what is essential for their operation reduces the attack surface and minimizes vulnerabilities, which mitigates a wide range of techniques.
References
|
| PR.AA-03.03 | Email verification mechanisms | Mitigates | T1598.002 | Spearphishing Attachment |
Comments
This diagnostic statement provides protection from phishing attacks through the implementation of software configuration methods, such as anti-spoofing and email authentication. Enabling mechanisms like, SPF and DKIM, add protection against adversaries that may send spearphishing emails with a malicious attachment to gain elicit sensitive information.
References
|
| PR.PS-01.03 | Configuration deviation | Mitigates | T1598.002 | Spearphishing Attachment |
Comments
This diagnostic statement provides protection from Phishing for Information: Spearphishing Attachment through the implementation of security configuration baselines for OS, software, file integrity monitoring and imaging. Security baseline configuration that uses anti-spoofing, email authentication mechanisms, external email tracking, encryption of credential data, and integrity checking can help protect against adversaries attempting to gather information.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CA-07 | Continuous Monitoring | mitigates | T1598.002 | Spearphishing Attachment | |
| CM-06 | Configuration Settings | mitigates | T1598.002 | Spearphishing Attachment | |
| IA-09 | Service Identification and Authentication | mitigates | T1598.002 | Spearphishing Attachment | |
| SC-20 | Secure Name/Address Resolution Service (Authoritative Source) | mitigates | T1598.002 | Spearphishing Attachment | |
| SC-44 | Detonation Chambers | mitigates | T1598.002 | Spearphishing Attachment | |
| SI-08 | Spam Protection | mitigates | T1598.002 | Spearphishing Attachment | |
| SI-03 | Malicious Code Protection | mitigates | T1598.002 | Spearphishing Attachment | |
| CM-02 | Baseline Configuration | mitigates | T1598.002 | Spearphishing Attachment | |
| SI-04 | System Monitoring | mitigates | T1598.002 | Spearphishing Attachment | |
| AC-04 | Information Flow Enforcement | mitigates | T1598.002 | Spearphishing Attachment | |
| SC-07 | Boundary Protection | mitigates | T1598.002 | Spearphishing Attachment |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CVE-2021-33739 | Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability | exploitation_technique | T1598.002 | Spearphishing Attachment |
Comments
Local escalation of privilege attack. Attacker would most likely gain access through an executable or script on the local computer sent to the user via an email attachment.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| DEF-SATT-E3 | Safe Attachments | Technique Scores | T1598.002 | Spearphishing Attachment |
Comments
M365's Safe Attachments is a feature that provides advanced email security by scanning attachments for malicious content and using a virtual environment to check for malicious actions in a process known as detonation. Safe Attachments for SharePoint, OneDrive, and Microsoft Teams operates in real-time to detect against emerging threats. If a suspicious file is identified, this file can be quarantined or blocked access to prevent potential harm.
License requirements:
Mirosoft 365 E5, Defender for Office Plan 1, Microsoft 365 E3 with ATP add-on
References
|
| DEF-SATT-E3 | Safe Attachments | Technique Scores | T1598.002 | Spearphishing Attachment |
Comments
M365's Safe Attachments is a feature that provides advanced email security by scanning attachments for malicious content and using a virtual environment to check for malicious actions in a process known as detonation. Safe Attachments for SharePoint, OneDrive, and Microsoft Teams operates in real-time to detect against emerging threats. If a suspicious file is identified, this file can be quarantined or blocked access to prevent potential harm.
License requirements:
Mirosoft 365 E5, Defender for Office Plan 1, Microsoft 365 E3 with ATP add-on
References
|
| DEF-SIMT-E5 | ATT&CK Simulation Training | Technique Scores | T1598.002 | Spearphishing Attachment |
Comments
M365's Defender Attack Simulation Training allows organizations to automate the simulation of benign real-world cyberattacks. These simulation automations feature social engineering techniques, payloads, and can start on an automated schedule. This detection focused security control partially improves organizations security posture by continuously conduct attack simulations that fine tune analytics, and provide hands-on training for users and cyber professionals to improve response capabilities.
The following social engineering techniques are available:
Credential Harvest: Attempts to collect credentials by taking users to a well-known looking website with input boxes to submit a username and password.
Malware Attachment: Adds a malicious attachment to a message. When the user opens the attachment, arbitrary code is run that helps the attacker compromise the target's device.
Link in Attachment: A type of credential harvest hybrid. An attacker inserts a URL into an email attachment. The URL within the attachment follows the same technique as credential harvest.
Link to Malware: Runs some arbitrary code from a file hosted on a well-known file sharing service. The message sent to the user contains a link to this malicious file, opening the file and helping the attacker compromise the target's device.
Drive-by URL: The malicious URL in the message takes the user to a familiar-looking website that silently runs and/or installs code on the user's device.
OAuth Consent Grant: The malicious URL asks users to grant permissions to data for a malicious Azure Application.
License Requirements:
Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2.
References
|