T1566 Phishing | thrunt.me

Technique: T1566
Tactics: Initial Access
Research, 90 days: 5
KEV CVEs mapped: 6
SigmaHQ rules: 14
Elastic, Splunk: 74
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1566

MITRE description

Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services (like social media platforms) or delivered via calendar invites. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., [Email Hiding Rules](https://attack.mitre.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spam 2022)(Citation: Palo Alto Unit 42 VBA Infostealer 2014) Another way to accomplish this is by [Email Spoofing](https://attack.mitre.org/techniques/T1684/002)(Citation: Proofpoint-spoof) the identity of the sender, which can be used to fool both the human recipient as well as automated security tools,(Citation: cyberproof-double-bounce) or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., "thread hijacking").(Citation: phishing-krebs) Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,(Citation: sygnia Luna Month)(Citation: CISA Remote Monitoring and Management Software) or install adversary-accessible remote management tools onto their computer (i.e., [User Execution](https://attack.mitre.org/techniques/T1204)).(Citation: Unit42 Luna Moth)

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-29 Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
2026-10-28 ReliaQuest: Residential Proxies Mask Social-Engineering Attacks
2026-10-26 Arctic Wolf: Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access
2026-09-10 Microsoft Threat Intelligence: Protecting organizations from AI-assisted executive impersonation and invoice fraud
2026-08-13 Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them

Detection coverage

SigmaHQ community rules

CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum (emerging-threats)
CVE-2021-31979 CVE-2021-33771 Exploits (emerging-threats)
WebDAV Temporary Local File Creation (threat-hunting)
Potential Malicious Usage of CloudTrail System Manager (core)
Okta FastPass Phishing Detection (core)
Suspicious Execution via macOS Script Editor (core)
Download From Suspicious TLD - Blacklist (core)
Download From Suspicious TLD - Whitelist (core)
Suspicious External WebDAV Execution (core)
Potential Initial Access via DLL Search Order Hijacking (core)
HTML Help HH.EXE Suspicious Child Process (core)
Suspicious HH.EXE Execution (core)
Suspicious Microsoft OneNote Child Process (core)
Phishing Pattern ISO in Archive (core)

Elastic and Splunk rules

Showing 25 of 74.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.