An attachment is the oldest trick in phishing and it still works, because opening a file feels routine. MITRE T1566.001, Spearphishing Attachment, is the variant where the email carries the malware itself. It is an initial access technique for Linux, macOS and Windows.
How attackers use it
MITRE describes spearphishing as electronically delivered social engineering aimed at a specific person, company or industry. In this variant, the adversary attaches a file and usually relies on User Execution to get code running.
The attachment can be a Microsoft Office document, an executable, a PDF or an archive. When it is opened, possibly after the user clicks past protections, the payload exploits a vulnerability or runs directly on the user's system.
Several details from MITRE are worth knowing because they shape detection:
- The email text gives a plausible reason to open the file, and may explain how to get around system protections to do so.
- It may include instructions for decrypting an attachment, such as a zip password, which is a way to evade email boundary defenses.
- Adversaries often manipulate file extensions and icons so an executable looks like a document, or a file that exploits one application looks like it is meant for another.
How to detect it
MITRE's detection strategy correlates delivery with what happens next. The behavior chain is inbound email metadata, then an attachment stored on disk, then process execution, then outbound network activity.
By platform:
- Windows and general: suspicious email delivery followed by file creation and abnormal process execution, such as an Office application starting PowerShell or cmd.
- Linux: mail logs linked to file creation in mail directories, followed by suspicious processes. Look for unexpected binaries or scripts started from user mail directories and unusual outbound traffic.
- macOS: Mail app logs, file creation in user directories and odd process execution, such as Preview or Mail starting Terminal or scripting binaries, with network traffic after the attachment is opened.
Useful log sources include your mail gateway, endpoint process creation events, such as Sysmon Event ID 1 or Windows Security Event ID 4688, and web proxy or firewall logs for the connection that follows.
How to reduce the risk
MITRE lists five mitigations.
- Antivirus/Antimalware. Automatically quarantine suspicious files.
- User Account Management. Limit which accounts can open or run files that arrive as attachments. Fewer privileges means a smaller blast radius when a file runs.
- Audit. Enable auditing and monitoring for email attachments and file transfers, and review logs for anomalies, including attempts to execute or interact with these files. This helps catch spearphishing before it becomes a compromise.
- Network Intrusion Prevention. Use systems that scan for and remove malicious email attachments.
- Software Configuration. Use SPF and DKIM based filtering and enforce them with policies such as DMARC so recipients can validate sender domains and message integrity.
In practical terms, that translates to a short checklist: scan and sandbox at the gateway, block executable and script attachment types you do not need, treat password-protected archives as high risk, run staff with standard accounts, and check authentication of sender domains.
Check your own environment
- Which attachment types does your gateway allow? Are executables, scripts, shortcuts and disk images blocked for users who do not need them?
- Can you query endpoints for Office applications that started a command interpreter in the last 30 days?
- Do you log attachments saved to disk with the mail client as the parent process?
- Is DMARC enforced? A read-only check:
dig +short TXT _dmarc.example.com
- Do users have a one-click way to report a message, and does someone answer within the day?
Investigating a hit
When an alert fires, work backward from the process. Find the document that launched it, find the message it came from, then list everyone else who received that message. After that, look forward: what did the spawned process connect to, what files did it write, and did it create anything that survives a reboot? Pull the message from all mailboxes once you have confirmed it is malicious.
False positives exist. Some business macros legitimately start scripts, and some finance tools do start interpreters. Document those known-good chains by name so that new ones stand out.
A note on archives and passwords
MITRE calls out zip passwords included in the email text. A gateway cannot scan an encrypted archive, so a message with an encrypted attachment and the password in the body is a pattern many teams choose to quarantine or flag, according to their own policy. Decide on it deliberately instead of letting it default.
Quick check
What is the typical chain MITRE describes for this technique?
Inbound email, attachment stored on disk, process execution, then outbound network activity.
Why do adversaries put a zip password in the email body?
To evade email boundary defenses, since scanners cannot inspect an encrypted archive.
Which child process of Office should raise an eyebrow?
PowerShell or cmd, which MITRE gives as an example of abnormal process execution after an attachment is opened.
