Spearphishing Attachment (T1598.002) is a sub-technique of Phishing for Information in the reconnaissance tactic. Its platform is PRE.
The word attachment makes people think of malware. In this technique the file is often there to collect information, not to infect anything.
How attackers use it
MITRE says adversaries attach a file to a spearphishing email in order to elicit sensitive information. All forms of spearphishing are electronically delivered social engineering aimed at a specific individual, company or industry.
In some cases they rely on the recipient filling in information and returning the file. The email usually gives a plausible reason, such as a request for information from a business associate. In other cases, MITRE says adversaries may use techniques such as HTML Smuggling to harvest credentials through fake login portals.
They may also use earlier reconnaissance, like searching open websites or victim-owned websites, to build persuasive lures.
The point for defenders is that a file with no macros and no executable code can still do the damage. A scanner that only looks for malware will pass it.
How to detect it
MITRE gives these ideas:
- Look for suspicious email activity, such as numerous accounts receiving messages from a single unusual or unknown sender.
- Use DKIM, SPF or header analysis to spot spoofed senders.
- Monitor network data for uncommon flows, and treat processes that use the network but never normally do as suspicious.
- Analyze traffic patterns for protocols that do not follow expected standards, and correlate with process and command line monitoring.
A useful addition: look at attachments that open a web page or post data to an external address when opened. That behavior is a sign that the file is a form, not a document.
How to reduce the risk
MITRE lists:
- User Training, to recognize social engineering and spearphishing attempts.
- Software Configuration: use SPF and DKIM based anti-spoofing and email authentication, enforced through policies such as DMARC, so recipients can filter on sender validity and message integrity.
Add a rule of thumb for staff: a request to fill in a form and send it back, with details about systems or accounts, is a request for information. Verify it through a known contact.
Check your own environment
Look up the email authentication policy for your domain (any OS with dig):
dig +short TXT _dmarc.your-domain.example
Then review:
- Does the email gateway report on attachments that contain links or forms?
- Can employees report a suspicious message quickly?
- Are external senders marked in the message?
Quick check
Why can an attachment with no malware still be an attack?
In this technique the file may be a form for the victim to fill in and return, or it may deliver a fake login portal, so the harm is information loss rather than code execution.
