MITRE ATT&CK technique · Initial Access

`T1566.002` Spearphishing Link

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

Clop
Sandworm
Earth Lusca

Sigma rules to hunt it

Potential Malicious Usage of CloudTrail System Managerhightest · aws
Suspicious Execution via macOS Script Editormediumtest · macos
Suspicious Email Delivered In Microsoft 365mediumexperimental · m365

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.