Phishing for Information (T1598) is a reconnaissance technique in MITRE ATT&CK. Its platform is PRE. The adversary sends messages to get you to hand over sensitive information that helps with targeting later.
MITRE draws a clear line between this and ordinary phishing. With Phishing for Information the goal is to gather data from the victim, not to execute malicious code on their system. Credentials are the most common prize, but any actionable detail counts.
That distinction changes how you spot it. There may be no attachment to scan and no payload to detonate. The message is the whole attack.
How attackers use it
MITRE says all forms of phishing are electronically delivered social engineering. It can be targeted, which is called spearphishing, where a specific individual, company or industry is chosen. It can also be non-targeted, such as mass credential harvesting campaigns.
Adversaries may also try to get information directly by exchanging emails, instant messages or other electronic conversation. Victims may receive messages that tell them to call a phone number, where the adversary tries to collect confidential information.
The social engineering often includes:
- Posing as a source with a reason to collect information. MITRE links this to establishing accounts or compromising accounts, so the sender may look legitimate.
- Sending multiple, seemingly urgent messages.
- Email spoofing of the sender identity, which can fool both the human recipient and automated security tools.
MITRE adds that phishing for information may use evasive techniques, such as removing or manipulating emails or metadata and headers from compromised accounts that are being abused to send messages.
There are four sub-techniques, which follow the delivery method:
- Spearphishing Service (T1598.001), via third-party services such as social media and personal webmail
- Spearphishing Attachment (T1598.002)
- Spearphishing Link (T1598.003)
- Spearphishing Voice (T1598.004)
What an adversary learns this way can fuel further steps. That is why the reconnaissance label matters. A single reply with an org chart, a tool name or a login can make the next attempt far more believable.
How to detect it
MITRE's detection guidance varies by method.
For email:
- Look for suspicious email activity, such as numerous accounts receiving messages from a single unusual or unknown sender.
- Use filtering based on DKIM and SPF, or header analysis, to find spoofed senders.
For links:
- Monitor for references to uncategorized or known-bad sites.
- Use URL inspection in email, including expanding shortened links, to find links leading to known malicious sites.
For social media:
- Watch for suspicious activity, including messages requesting information and abnormal file or data transfers, especially involving unknown or suspicious accounts.
For voice:
- Review call logs from corporate devices for patterns of potential voice phishing, such as calls to or from known malicious phone numbers.
For the network in general, MITRE adds the usual analytics: monitor network data for uncommon flows, and treat processes that use the network but do not normally, or have never been seen doing so, as suspicious. Correlate traffic patterns with process monitoring and command lines.
The data sources MITRE lists around this technique come down to what you can actually collect: email gateway logs and headers, web proxy and DNS logs, social media and messaging activity where you can see it, telephony logs, and network traffic.
A practical tip: give people an easy way to report a message as suspicious, and treat a report as a detection event. People catch things tools do not, and a report that arrives while the message is still fresh is worth more than a quarterly click-rate number.
How to reduce the risk
MITRE lists two mitigations for the parent technique.
- User Training. Users can be trained to identify social engineering techniques and spearphishing attempts. Keep it concrete and recent. Show what a request for information looks like when it comes from a plausible contact, and remind people that urgency is itself a flag.
- Software Configuration. Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (SPF) and integrity of messages (DKIM). Enabling these through policies such as DMARC lets recipients, inside the organization and across domains, perform similar filtering and validation.
Add a few habits on top:
- Define who is allowed to ask for what by email. If requests for credentials or internal details are never legitimate, say so.
- Give staff a known callback number for verifying requests, rather than trusting the number in the message.
- Treat unexpected contact on social media and personal webmail as untrusted, since those services often have less strict security than your enterprise.
Check your own environment
Look up the email authentication records for your domain (any OS with dig):
dig +short TXT your-domain.example
dig +short TXT _dmarc.your-domain.example
The first should include an SPF record. The second should return a DMARC policy. DKIM records live under a selector name chosen by your mail provider, so check your provider's documentation for the name to query.
Then ask yourself:
- Is DMARC published, and is the policy set to do something more than monitor?
- Can employees report a suspicious message in one click?
- Do you review reported messages and trace which accounts received the same one?
- Have staff been told that requests for information by phone can be spoofed too?
Quick check
How is Phishing for Information different from Phishing?
Its objective is to gather information from the victim, such as credentials, not to execute malicious code on the victim's system.
Which two controls does MITRE list for the parent technique?
User Training, and Software Configuration using SPF, DKIM and DMARC style email authentication.
Why do some of these messages ask the recipient to phone a number?
MITRE notes that victims may be told to call a number where the adversary attempts to collect confidential information, which sidesteps email filtering.
