Esc
Phishing - T1566

(ATT&CK® Technique)
Subtechniques

Definition

Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.
D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.
        graph LR;

     T1566["Phishing"] --> |produces| File["File"]; class T1566 OffensiveTechniqueNode;
        class File ArtifactNode; click File href "../../../dao/artifact/d3f:File";
        click T1566 href "../../../offensive-technique/attack/T1566/"; click File href "../../../dao/artifact/d3f:File"; T1566["Phishing"] --> |produces| URL["URL"]; class T1566 OffensiveTechniqueNode;
        class URL ArtifactNode; click URL href "../../../dao/artifact/d3f:URL";
        click T1566 href "../../../offensive-technique/attack/T1566/"; click URL href "../../../dao/artifact/d3f:URL"; T1566["Phishing"] --> |produces| InboundInternetMailTraffic["Inbound Internet Mail Traffic"]; class T1566 OffensiveTechniqueNode;
        class InboundInternetMailTraffic ArtifactNode; click InboundInternetMailTraffic href "../../../dao/artifact/d3f:InboundInternetMailTraffic";
        click T1566 href "../../../offensive-technique/attack/T1566/"; click InboundInternetMailTraffic href "../../../dao/artifact/d3f:InboundInternetMailTraffic"; T1566["Phishing"] --> |produces| Email["Email"]; class T1566 OffensiveTechniqueNode;
        class Email ArtifactNode; click Email href "../../../dao/artifact/d3f:Email";
        click T1566 href "../../../offensive-technique/attack/T1566/"; click Email href "../../../dao/artifact/d3f:Email";                                                    DecoyFile["Decoy File"] -->
          | spoofs | File["File"];

          DecoyFile["Decoy File"] -.->
            | may-deceive | T1566["Phishing"] ;
          class DecoyFile DefensiveTechniqueNode;
          class File ArtifactNode;
          click DecoyFile href "../../../technique/d3f:DecoyFile"; DecoyFile["Decoy File"] -->
          | spoofs | Email["Email"];

          
          class DecoyFile DefensiveTechniqueNode;
          class Email ArtifactNode;
          click DecoyFile href "../../../technique/d3f:DecoyFile";                           DynamicAnalysis["Dynamic Analysis"] -->
          | analyzes | Email["Email"];

          DynamicAnalysis["Dynamic Analysis"] -.->
            | may-detect | T1566["Phishing"] ;
          class DynamicAnalysis DefensiveTechniqueNode;
          class Email ArtifactNode;
          click DynamicAnalysis href "../../../technique/d3f:DynamicAnalysis";              EmulatedFileAnalysis["Emulated File Analysis"] -->
          | analyzes | Email["Email"];

          EmulatedFileAnalysis["Emulated File Analysis"] -.->
            | may-detect | T1566["Phishing"] ;
          class EmulatedFileAnalysis DefensiveTechniqueNode;
          class Email ArtifactNode;
          click EmulatedFileAnalysis href "../../../technique/d3f:EmulatedFileAnalysis";              InboundSessionVolumeAnalysis["Inbound Session Volume Analysis"] -->
          | analyzes | InboundInternetMailTraffic["Inbound Internet Mail Traffic"];

          InboundSessionVolumeAnalysis["Inbound Session Volume Analysis"] -.->
            | may-detect | T1566["Phishing"] ;
          class InboundSessionVolumeAnalysis DefensiveTechniqueNode;
          class InboundInternetMailTraffic ArtifactNode;
          click InboundSessionVolumeAnalysis href "../../../technique/d3f:InboundSessionVolumeAnalysis"; NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -->
          | analyzes | InboundInternetMailTraffic["Inbound Internet Mail Traffic"];

          NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -.->
            | may-detect | T1566["Phishing"] ;
          class NetworkTrafficCommunityDeviation DefensiveTechniqueNode;
          class InboundInternetMailTraffic ArtifactNode;
          click NetworkTrafficCommunityDeviation href "../../../technique/d3f:NetworkTrafficCommunityDeviation";               PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -->
          | analyzes | InboundInternetMailTraffic["Inbound Internet Mail Traffic"];

          PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -.->
            | may-detect | T1566["Phishing"] ;
          class PerHostDownload-UploadRatioAnalysis DefensiveTechniqueNode;
          class InboundInternetMailTraffic ArtifactNode;
          click PerHostDownload-UploadRatioAnalysis href "../../../technique/d3f:PerHostDownload-UploadRatioAnalysis";                          NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -->
          | analyzes | InboundInternetMailTraffic["Inbound Internet Mail Traffic"];

          NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -.->
            | may-detect | T1566["Phishing"] ;
          class NetworkTrafficSignatureAnalysis DefensiveTechniqueNode;
          class InboundInternetMailTraffic ArtifactNode;
          click NetworkTrafficSignatureAnalysis href "../../../technique/d3f:NetworkTrafficSignatureAnalysis"; RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -->
          | analyzes | InboundInternetMailTraffic["Inbound Internet Mail Traffic"];

          RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -.->
            | may-detect | T1566["Phishing"] ;
          class RemoteTerminalSessionDetection DefensiveTechniqueNode;
          class InboundInternetMailTraffic ArtifactNode;
          click RemoteTerminalSessionDetection href "../../../technique/d3f:RemoteTerminalSessionDetection";               Client-serverPayloadProfiling["Client-server Payload Profiling"] -->
          | analyzes | InboundInternetMailTraffic["Inbound Internet Mail Traffic"];

          Client-serverPayloadProfiling["Client-server Payload Profiling"] -.->
            | may-detect | T1566["Phishing"] ;
          class Client-serverPayloadProfiling DefensiveTechniqueNode;
          class InboundInternetMailTraffic ArtifactNode;
          click Client-serverPayloadProfiling href "../../../technique/d3f:Client-serverPayloadProfiling";                ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -->
          | analyzes | InboundInternetMailTraffic["Inbound Internet Mail Traffic"];

          ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -.->
            | may-detect | T1566["Phishing"] ;
          class ProtocolMetadataAnomalyDetection DefensiveTechniqueNode;
          class InboundInternetMailTraffic ArtifactNode;
          click ProtocolMetadataAnomalyDetection href "../../../technique/d3f:ProtocolMetadataAnomalyDetection";                        SenderMTAReputationAnalysis["Sender MTA Reputation Analysis"] -->
          | analyzes | Email["Email"];

          SenderMTAReputationAnalysis["Sender MTA Reputation Analysis"] -.->
            | may-detect | T1566["Phishing"] ;
          class SenderMTAReputationAnalysis DefensiveTechniqueNode;
          class Email ArtifactNode;
          click SenderMTAReputationAnalysis href "../../../technique/d3f:SenderMTAReputationAnalysis"; SenderReputationAnalysis["Sender Reputation Analysis"] -->
          | analyzes | Email["Email"];

          SenderReputationAnalysis["Sender Reputation Analysis"] -.->
            | may-detect | T1566["Phishing"] ;
          class SenderReputationAnalysis DefensiveTechniqueNode;
          class Email ArtifactNode;
          click SenderReputationAnalysis href "../../../technique/d3f:SenderReputationAnalysis";                           HomoglyphDetection["Homoglyph Detection"] -->
          | analyzes | URL["URL"];

          HomoglyphDetection["Homoglyph Detection"] -.->
            | may-detect | T1566["Phishing"] ;
          class HomoglyphDetection DefensiveTechniqueNode;
          class URL ArtifactNode;
          click HomoglyphDetection href "../../../technique/d3f:HomoglyphDetection"; URLAnalysis["URL Analysis"] -->
          | analyzes | URL["URL"];

          URLAnalysis["URL Analysis"] -.->
            | may-detect | T1566["Phishing"] ;
          class URLAnalysis DefensiveTechniqueNode;
          class URL ArtifactNode;
          click URLAnalysis href "../../../technique/d3f:URLAnalysis"; HomoglyphDetection["Homoglyph Detection"] -->
          | analyzes | Email["Email"];

          
          class HomoglyphDetection DefensiveTechniqueNode;
          class Email ArtifactNode;
          click HomoglyphDetection href "../../../technique/d3f:HomoglyphDetection";                                        IdentifierActivityAnalysis["Identifier Activity Analysis"] -->
          | analyzes | URL["URL"];

          IdentifierActivityAnalysis["Identifier Activity Analysis"] -.->
            | may-detect | T1566["Phishing"] ;
          class IdentifierActivityAnalysis DefensiveTechniqueNode;
          class URL ArtifactNode;
          click IdentifierActivityAnalysis href "../../../technique/d3f:IdentifierActivityAnalysis";              UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -->
          | analyzes | InboundInternetMailTraffic["Inbound Internet Mail Traffic"];

          UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -.->
            | may-detect | T1566["Phishing"] ;
          class UserGeolocationLogonPatternAnalysis DefensiveTechniqueNode;
          class InboundInternetMailTraffic ArtifactNode;
          click UserGeolocationLogonPatternAnalysis href "../../../technique/d3f:UserGeolocationLogonPatternAnalysis";              FileIntegrityMonitoring["File Integrity Monitoring"] -->
          | analyzes | Email["Email"];

          FileIntegrityMonitoring["File Integrity Monitoring"] -.->
            | may-detect | T1566["Phishing"] ;
          class FileIntegrityMonitoring DefensiveTechniqueNode;
          class Email ArtifactNode;
          click FileIntegrityMonitoring href "../../../technique/d3f:FileIntegrityMonitoring"; FileIntegrityMonitoring["File Integrity Monitoring"] -->
          | analyzes | File["File"];

          
          class FileIntegrityMonitoring DefensiveTechniqueNode;
          class File ArtifactNode;
          click FileIntegrityMonitoring href "../../../technique/d3f:FileIntegrityMonitoring";                           FileEviction["File Eviction"] -->
          | deletes | Email["Email"];

          FileEviction["File Eviction"] -.->
            | may-evict | T1566["Phishing"] ;
          class FileEviction DefensiveTechniqueNode;
          class Email ArtifactNode;
          click FileEviction href "../../../technique/d3f:FileEviction"; FileEviction["File Eviction"] -->
          | deletes | File["File"];

          
          class FileEviction DefensiveTechniqueNode;
          class File ArtifactNode;
          click FileEviction href "../../../technique/d3f:FileEviction";                           ContentQuarantine["Content Quarantine"] -->
          | quarantines | Email["Email"];

          ContentQuarantine["Content Quarantine"] -.->
            | may-isolate | T1566["Phishing"] ;
          class ContentQuarantine DefensiveTechniqueNode;
          class Email ArtifactNode;
          click ContentQuarantine href "../../../technique/d3f:ContentQuarantine";        ContentQuarantine["Content Quarantine"] -->
          | quarantines | File["File"];

          
          class ContentQuarantine DefensiveTechniqueNode;
          class File ArtifactNode;
          click ContentQuarantine href "../../../technique/d3f:ContentQuarantine";  ContentModification["Content Modification"] -->
          | modifies | File["File"];

          ContentModification["Content Modification"] -.->
            | may-isolate | T1566["Phishing"] ;
          class ContentModification DefensiveTechniqueNode;
          class File ArtifactNode;
          click ContentModification href "../../../technique/d3f:ContentModification"; ContentModification["Content Modification"] -->
          | modifies | Email["Email"];

          
          class ContentModification DefensiveTechniqueNode;
          class Email ArtifactNode;
          click ContentModification href "../../../technique/d3f:ContentModification";                                             FileEncryption["File Encryption"] -->
          | encrypts | File["File"];

          FileEncryption["File Encryption"] -.->
            | may-harden | T1566["Phishing"] ;
          class FileEncryption DefensiveTechniqueNode;
          class File ArtifactNode;
          click FileEncryption href "../../../technique/d3f:FileEncryption"; FileEncryption["File Encryption"] -->
          | encrypts | Email["Email"];

          
          class FileEncryption DefensiveTechniqueNode;
          class Email ArtifactNode;
          click FileEncryption href "../../../technique/d3f:FileEncryption";                           NetworkTrafficFiltering["Network Traffic Filtering"] -->
          | filters | InboundInternetMailTraffic["Inbound Internet Mail Traffic"];

          NetworkTrafficFiltering["Network Traffic Filtering"] -.->
            | may-isolate | T1566["Phishing"] ;
          class NetworkTrafficFiltering DefensiveTechniqueNode;
          class InboundInternetMailTraffic ArtifactNode;
          click NetworkTrafficFiltering href "../../../technique/d3f:NetworkTrafficFiltering"; LocalFilePermissions["Local File Permissions"] -->
          | restricts | File["File"];

          LocalFilePermissions["Local File Permissions"] -.->
            | may-isolate | T1566["Phishing"] ;
          class LocalFilePermissions DefensiveTechniqueNode;
          class File ArtifactNode;
          click LocalFilePermissions href "../../../technique/d3f:LocalFilePermissions"; LocalFilePermissions["Local File Permissions"] -->
          | restricts | Email["Email"];

          
          class LocalFilePermissions DefensiveTechniqueNode;
          class Email ArtifactNode;
          click LocalFilePermissions href "../../../technique/d3f:LocalFilePermissions";                                                      RestoreFile["Restore File"] -->
          | restores | Email["Email"];

          RestoreFile["Restore File"] -.->
            | may-restore | T1566["Phishing"] ;
          class RestoreFile DefensiveTechniqueNode;
          class Email ArtifactNode;
          click RestoreFile href "../../../technique/d3f:RestoreFile"; RestoreFile["Restore File"] -->
          | restores | File["File"];

          
          class RestoreFile DefensiveTechniqueNode;
          class File ArtifactNode;
          click RestoreFile href "../../../technique/d3f:RestoreFile";                           FileAnalysis["File Analysis"] -->
          | analyzes | File["File"];

          FileAnalysis["File Analysis"] -.->
            | may-detect | T1566["Phishing"] ;
          class FileAnalysis DefensiveTechniqueNode;
          class File ArtifactNode;
          click FileAnalysis href "../../../technique/d3f:FileAnalysis"; FileAnalysis["File Analysis"] -->
          | analyzes | Email["Email"];

          
          class FileAnalysis DefensiveTechniqueNode;
          class Email ArtifactNode;
          click FileAnalysis href "../../../technique/d3f:FileAnalysis";                           ContentFiltering["Content Filtering"] -->
          | filters | File["File"];

          ContentFiltering["Content Filtering"] -.->
            | may-isolate | T1566["Phishing"] ;
          class ContentFiltering DefensiveTechniqueNode;
          class File ArtifactNode;
          click ContentFiltering href "../../../technique/d3f:ContentFiltering"; ContentFiltering["Content Filtering"] -->
          | filters | Email["Email"];

          
          class ContentFiltering DefensiveTechniqueNode;
          class Email ArtifactNode;
          click ContentFiltering href "../../../technique/d3f:ContentFiltering";                           URLReputationAnalysis["URL Reputation Analysis"] -->
          | analyzes | URL["URL"];

          URLReputationAnalysis["URL Reputation Analysis"] -.->
            | may-detect | T1566["Phishing"] ;
          class URLReputationAnalysis DefensiveTechniqueNode;
          class URL ArtifactNode;
          click URLReputationAnalysis href "../../../technique/d3f:URLReputationAnalysis";              EmailRemoval["Email Removal"] -->
          | deletes | Email["Email"];

          EmailRemoval["Email Removal"] -.->
            | may-evict | T1566["Phishing"] ;
          class EmailRemoval DefensiveTechniqueNode;
          class Email ArtifactNode;
          click EmailRemoval href "../../../technique/d3f:EmailRemoval";              EmailFiltering["Email Filtering"] -->
          | filters | Email["Email"];

          EmailFiltering["Email Filtering"] -.->
            | may-isolate | T1566["Phishing"] ;
          class EmailFiltering DefensiveTechniqueNode;
          class Email ArtifactNode;
          click EmailFiltering href "../../../technique/d3f:EmailFiltering";              RemoteFileAccessMediation["Remote File Access Mediation"] -->
          | isolates | File["File"];

          RemoteFileAccessMediation["Remote File Access Mediation"] -.->
            | may-isolate | T1566["Phishing"] ;
          class RemoteFileAccessMediation DefensiveTechniqueNode;
          class File ArtifactNode;
          click RemoteFileAccessMediation href "../../../technique/d3f:RemoteFileAccessMediation"; RemoteFileAccessMediation["Remote File Access Mediation"] -->
          | isolates | Email["Email"];

          
          class RemoteFileAccessMediation DefensiveTechniqueNode;
          class Email ArtifactNode;
          click RemoteFileAccessMediation href "../../../technique/d3f:RemoteFileAccessMediation";                           InboundTrafficFiltering["Inbound Traffic Filtering"] -->
          | filters | InboundInternetMailTraffic["Inbound Internet Mail Traffic"];

          InboundTrafficFiltering["Inbound Traffic Filtering"] -.->
            | may-isolate | T1566["Phishing"] ;
          class InboundTrafficFiltering DefensiveTechniqueNode;
          class InboundInternetMailTraffic ArtifactNode;
          click InboundTrafficFiltering href "../../../technique/d3f:InboundTrafficFiltering";              RestoreEmail["Restore Email"] -->
          | restores | Email["Email"];

          RestoreEmail["Restore Email"] -.->
            | may-restore | T1566["Phishing"] ;
          class RestoreEmail DefensiveTechniqueNode;
          class Email ArtifactNode;
          click RestoreEmail href "../../../technique/d3f:RestoreEmail";
json