← Threat archive

T1566.001 Phishing: Spearphishing Attachment

2 threats tracked by Spectrum Delta use this technique.

T1566.001 on MITRE ATT&CK →

  • Sirius backdoor FedEx fileless

    FedEx-invoice PDF /Launch executes PowerShell

    Sysmon EID 1 (Acrobat.exe/AcroRd32.exe parent, powershell.exe child with the hidden/bypass/encoded command line) + EID 4104 if script block logging captures the unpacker one-liner

    Seen in: Windows process creation, PowerShell script block logging

  • Wazza device-code phishkit

    Spearphishing attachment: branded PDF lures from compromised senders

    Email-gateway events: business-themed PDF attachments from external or compromised senders; embedded external links are visible where attachment inspection or link extraction is deployed, not from ordinary mail metadata; web-proxy events for the same users clicking into sites[.]google[.]com staging pages or .eu domains shortly after, where URL visibility exists

    Seen in: Email gateway, Web proxy / DNS