T1566

Phishing

Initial Access

Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted (spearphishing) against a specific individual, company, or industry, or non-targeted such as mass malware spam campaigns. Adversaries send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems or steal credentials. Phishing may also be conducted via third-party services like social media platforms, via voice-based callback lures directing victims to call a phone number and then download malware or install remote management tools, or through thread hijacking by injecting malicious content into existing email conversations. Email spoofing, manipulation of authentication headers, and abuse of compromised legitimate accounts are common evasion techniques used to bypass automated security tooling and human suspicion alike.

Microsoft Sentinel / Defender
kusto 
let SuspiciousExtensions = dynamic([
  ".exe", ".dll", ".bat", ".cmd", ".ps1", ".vbs", ".js", ".hta", ".wsf",
  ".scr", ".pif", ".lnk", ".iso", ".img", ".cab", ".docm", ".xlsm", ".pptm", ".jar"
]);
let SuspiciousSubjectTerms = dynamic([
  "invoice", "payment", "urgent", "verify", "suspended", "confirm",
  "unusual activity", "password reset", "credentials", "wire transfer",
  "action required", "shared with you", "security alert", "your account"
]);
// Signal 1: Inbound email with phishing or malware verdict from Microsoft Defender for Office 365
let EmailThreatEvents =
    EmailEvents
    | where Timestamp > ago(24h)
    | where EmailDirection == "Inbound"
    | where ThreatTypes has_any ("Phish", "Malware") or (DeliveryAction == "Blocked" and ConfidenceLevel == "High")
    | extend AuthJson = parse_json(AuthenticationDetails)
    | extend SPFResult = tostring(AuthJson.SPF)
    | extend DKIMResult = tostring(AuthJson.DKIM)
    | extend DMARCResult = tostring(AuthJson.DMARC)
    | extend AuthFailed = (SPFResult =~ "Fail" or DKIMResult =~ "Fail" or DMARCResult =~ "Fail")
    | extend SuspiciousSubject = Subject has_any (SuspiciousSubjectTerms)
    | project Timestamp, NetworkMessageId, SenderFromAddress, SenderFromDomain,
             SenderIPv4, RecipientEmailAddress, Subject, ThreatTypes, ConfidenceLevel,
             DeliveryAction, DeliveryLocation, SuspiciousSubject,
             AuthFailed, SPFResult, DKIMResult, DMARCResult;
// Signal 2: Attachment metadata — suspicious file extensions or malware family hits
let AttachmentSignals =
    EmailAttachmentInfo
    | where Timestamp > ago(24h)
    | where FileName has_any (SuspiciousExtensions)
        or isnotempty(MalwareFamily)
        or ThreatTypes has_any ("Phish", "Malware")
    | summarize
        SuspiciousFiles = make_set(FileName, 10),
        MalwareFamilies = make_set(MalwareFamily, 5),
        AttachmentHashes = make_set(SHA256, 10)
      by NetworkMessageId;
// Signal 3: URLs extracted from email body — collect domains for threat intel correlation
let UrlSignals =
    EmailUrlInfo
    | where Timestamp > ago(24h)
    | summarize UrlCount = count(), LinkedDomains = make_set(UrlDomain, 20) by NetworkMessageId;
// Combine all signals and score
EmailThreatEvents
| join kind=leftouter AttachmentSignals on NetworkMessageId
| join kind=leftouter UrlSignals on NetworkMessageId
| extend HasMaliciousAttachment = isnotempty(SuspiciousFiles)
| extend ThreatScore =
    toint(ThreatTypes has "Phish") * 3 +
    toint(ThreatTypes has "Malware") * 3 +
    toint(HasMaliciousAttachment) * 2 +
    toint(AuthFailed) +
    toint(SuspiciousSubject)
| where ThreatScore > 0
| project Timestamp, SenderFromAddress, SenderFromDomain, SenderIPv4,
         RecipientEmailAddress, Subject, ThreatTypes, ConfidenceLevel,
         DeliveryAction, DeliveryLocation,
         SuspiciousFiles, MalwareFamilies, AttachmentHashes,
         UrlCount, LinkedDomains,
         SPFResult, DKIMResult, DMARCResult, AuthFailed,
         SuspiciousSubject, ThreatScore, NetworkMessageId
| sort by ThreatScore desc, Timestamp desc
high severity high confidence

Data Sources

Application Log: Application Log Content Network Traffic: Network Traffic Content Microsoft Defender for Office 365 Microsoft 365 Defender Advanced Hunting

Required Tables

EmailEvents EmailAttachmentInfo EmailUrlInfo

False Positives

  • Automated marketing and newsletter platforms (Mailchimp, Constant Contact, HubSpot) that send bulk email from shared infrastructure may trigger SPF/DKIM mismatches if not properly configured
  • Internal security awareness phishing simulation platforms (KnowBe4, Proofpoint Security Awareness, Cofense) deliberately send fake phishing emails and should be allowlisted by sender domain
  • Vendors or partners sending invoices or payment requests from cloud document-sharing services (DocuSign, Adobe Sign, Dropbox) may match subject-line keywords while being fully legitimate
  • Email delivery failure notifications (NDRs, mailer-daemon bounces) forwarded through multiple hops may fail DMARC alignment without being malicious
  • Internal IT helpdesk emails requesting credential resets or account verification may match SuspiciousSubjectTerms
Last updated: 2026-03-19 Research depth: deep
References (14)

Unlock Pro Content

Get the full detection package for T1566 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Sub-techniques (4)

Same Tactic: Initial Access

Popular Detections