Phishing is still how many intrusions begin. MITRE T1566, Phishing, is the parent of four subtechniques and sits under the initial access tactic. It applies to Windows, Linux, macOS, Office Suite, SaaS and identity provider environments.
What it is
MITRE defines all forms of phishing as electronically delivered social engineering. It can be targeted, which is spearphishing aimed at a person, company or industry, or untargeted, as in mass malware spam.
The four subtechniques each have a guide in this series: spearphishing attachment (T1566.001), spearphishing link (T1566.002), spearphishing via service (T1566.003) and spearphishing voice (T1566.004).
How attackers use it
MITRE describes several delivery styles at the parent level.
- Emails with malicious attachments or links, typically meant to run code on victim systems.
- Messages through third-party services such as social media platforms, or calendar invites.
- Social engineering, such as posing as a trusted source.
- Evasive techniques, such as removing or manipulating emails or headers on compromised accounts that are being used to send messages, for example with Email Hiding Rules.
- Email spoofing of the sender identity, which can fool both people and automated tools.
- Thread hijacking, where the intended target is added to an existing email thread that includes malicious files or links.
- Messages telling the victim to call a phone number, where they are directed to a malicious URL, a malware download or the installation of adversary-accessible remote management tools.
The thread in all of them is that a person is asked to do something. That is why phishing detection mixes technical signals with human reporting.
How to detect it
MITRE gives analytics by platform. The pattern is a chain, not a single event: a message arrives, something is saved or clicked, and then something runs or logs in.
- Windows and general: unusual inbound email where attachments or embedded URLs are followed by new processes or suspicious document behavior. Correlate email metadata, file creation and network activity after delivery.
- Linux: attachments or URLs opened in clients such as Thunderbird or mutt that lead to unusual file creation or outbound connections. Join mail logs, file writes and execution.
- macOS: Mail app activity where attachments are saved and executed quickly, or Safari or Preview opening linked URLs and files. Correlate Unified Logs with process execution.
- Office documents: embedded macros or links that spawn processes, seen through Office logs, suspicious child processes and outbound connections.
- Identity providers: anomalous logins from email invitations or fake SSO prompts, MFA bypass attempts and unusual geography after a phishing email lands.
- SaaS: chat or collaboration messages with malicious URLs or attachments, anomalous link clicks, suspicious file uploads or token misuse.
If you can only build one detection, make it Office or a browser spawning a shell or script interpreter. It is well documented, rare in normal work and fits several of the chains above.
How to reduce the risk
MITRE lists five mitigations.
- Audit. Scan systems, permissions, software and configurations to find weaknesses before they are used.
- Network Intrusion Prevention. Use systems that scan for and remove malicious email attachments or links to block activity.
- Software Configuration. Use email authentication so recipients can validate the sender domain with SPF and message integrity with DKIM, and enable them across the organization through policies such as DMARC.
- Restrict Web-Based Content. Decide whether certain websites or attachment types, such as
.scr,.exe,.pifand.cpl, are needed for business. Consider blocking them where activity cannot be monitored well or the risk is high. - Antivirus/Antimalware. Automatically quarantine suspicious files.
User reporting belongs next to these. A one-click report button and a fast reply to the reporter do more for detection than another reminder email.
Check your own environment
Start with your own domain. A read-only look at your published DMARC and SPF policy:
dig +short TXT _dmarc.example.com
dig +short TXT example.com
Replace the domain with yours. Then ask:
- Is DMARC published, and at an enforcing policy or only monitoring?
- Do you block attachment types you do not need, and inspect archives and password-protected files according to policy?
- Can you list, in one query, every user who clicked a link in a message later reported as phishing?
- Does your identity provider log sign-ins from unfamiliar devices, and do you review consent grants?
- Do staff know how to verify a caller?
What to do after a click
Treat the first hour as a scoping exercise. Pull the message from all mailboxes, list who received, opened and clicked, check for new inbox rules on those mailboxes, review recent sign-ins and token grants, and look at the endpoints for the process chains above. Resetting the credentials of anyone who entered them is a basic step.
Quick check
What is thread hijacking?
Including the target in an existing email thread that already contains malicious files or links, so the message looks like part of a conversation they know.
Which email standards does MITRE name as mitigations?
SPF for sender domain validation and DKIM for message integrity, enforced organization-wide through policies such as DMARC.
Why correlate email logs with endpoint logs?
Phishing is a chain: delivery, click or save, then execution or login. Each log shows only one link of it.
