Written Content (T1683.001) is a sub-technique of Generate Content. Adversaries create or tailor written material to support targeting and malicious operations. MITRE lists the Resource Development tactic and the PRE platform.
How attackers use it
MITRE's list of written content is broad:
- Phishing lures.
- Fraudulent financial communications.
- Fabricated job postings, employment credentials and documentation.
- Decoy documents.
- Social media persona content, and supporting narratives that keep fabricated personas alive over time.
It may be written by hand, commissioned from third parties, or produced with AI-assisted tools. Written materials may imitate government correspondence, diplomatic messages or internal organizational documents. AI tools can also tailor text to specific targets, industries or regions, for example by translating into the target's language or copying the style of a trusted sender.
The content supports Phishing (T1660), Spearphishing via Service (T1566.003), Phishing for Information (T1598), Internal Spearphishing (T1534), Social Engineering (T1684), Financial Theft (T1657) and Establish Accounts (T1585). MITRE separates it from malicious code, which is Develop Capabilities (T1587).
Examples on the technique page include forged tax compliance certificates produced from collected data, email content impersonating official notifications, decoy content resembling legitimate guidance, fake social media accounts used for targeting, and tailored branded phishing lures.
How to detect it
MITRE says this activity mostly happens outside the target's visibility. Detection should concentrate on related stages, such as Initial Access, where the content is delivered.
How to reduce the risk
The Pre-compromise mitigation applies, because preventive controls cannot reach the writing step. Advice from MITRE is to build defenses that do not depend on atomic indicators.
Things that help:
- Verify unusual requests through a known phone number or a separate platform.
- Check job offers and recruiter contacts through the company's official channels, not through links in the message.
- Block or flag lookalike domains and external senders using display names of your executives.
- Add friction for payments, password resets and access changes.
Quick check
Why is better grammar no longer a reliable phishing tell?
AI-assisted tools can translate content into the target's language and mimic a trusted sender's style, so lures can read cleanly and convincingly.
Sources
- MITRE ATT&CK, Written Content (T1683.001): https://attack.mitre.org/techniques/T1683/001
