Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-PretextingReconEmailTrackingBeacon.
Upgrade to ProDetect Pretexting Reconnaissance Email with Tracking Pixel / Beacon Link in Elastic Security
Before committing to a spearphishing attachment (T1598.002) or spearphishing link (T1598.003) payload, adversaries increasingly send an innocuous, low-payload pretexting email first — a brief 'checking in', 'meeting request', or 'invoice follow-up' message with no attachment and no overt malicious link. The email instead embeds a uniquely-tokenized tracking pixel (a 1x1 image or invisible-CSS beacon) or a benign-looking beacon link, where the token is minted per-recipient. When the recipient's mail client renders the image or a human clicks the link, the beacon fires a GET request back to adversary-controlled infrastructure, confirming the mailbox is live, fingerprinting the recipient's IP address, approximate geolocation, mail client/user agent, and open time, and validating that a real human (not a sandbox or secure email gateway detonation chamber) triggered it. Star Blizzard, TA453, and TA427 have been documented using single-pixel and unique-URL tracking beacons in low-content reconnaissance emails to qualify targets and time follow-on credential-harvesting or malware-laden messages for when the mailbox is confirmed active. Because these emails carry no attachment and no overtly malicious URL pattern, they routinely pass secure email gateway and sandbox scoring; detection instead relies on correlating the low-payload email itself (via EmailEvents/EmailUrlInfo) with the subsequent beacon fetch observed in web proxy/gateway logs.
MITRE ATT&CK
- Tactic
- Reconnaissance
Elastic Detection Query
/* Alert 1: pretexting recon email — no attachment, <=2 URLs, tracking token or pixel extension */
/* Run against email security telemetry ingested as ECS via Elastic email connectors (O365/Defender ingest) */
sequence by email.message_id with maxspan=1m
[email where event.type == "info" and
email.direction == "inbound" and
email.attachments == null]
[url where url.query : "*uid=*" or url.query : "*token=*" or url.query : "*tid=*" or
url.path : ("*.gif", "*.png", "*.jpg", "*.jpeg")]
/* Alert 2: beacon fire confirmation — proxy/network request to the tracking URL after delivery */
/* sequence by url.full with maxspan=3d
[email where event.type == "info" and email.direction == "inbound"]
[network where event.type == "connection" and destination.domain == url.domain]
*/Elastic EQL sequence detecting low-payload pretexting reconnaissance emails: an inbound email with no attachments followed (within the same message) by an embedded URL carrying a tracking-token query parameter or pointing to a raster image beacon. A commented follow-on sequence correlates the same tracking URL/domain against a subsequent network connection event within a 3-day window to confirm the beacon fired. Requires ECS-mapped email telemetry (via Elastic's O365/Defender for Office 365 ingest integration) alongside network/proxy events in the same data view.
Data Sources
Required Tables
False Positives & Tuning
- Marketing platforms (Mailchimp, HubSpot) whose tracking pixels/links match the same query-parameter and file-extension patterns — allow-list known marketing sender domains
- Sales engagement tooling (Outreach.io, Salesloft) generating per-recipient tracking links for legitimate outreach campaigns
- Internal security awareness phishing simulation platforms (KnowBe4, Proofpoint Security Awareness) that intentionally use tracking pixels/links to measure click-through — exclude by known simulation sending domains
Other platforms for THREAT-Recon-PretextingReconEmailTrackingBeacon
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Low-Payload Email with Unique Tracking Token URL
Expected signal: EmailEvents record with AttachmentCount=0, UrlCount=1; EmailUrlInfo record for the tracking URL containing a uid= query parameter matching the tracking token regex.
- Test 2Tracking Pixel Beacon Fetch Simulation
Expected signal: Web proxy/gateway access log entry showing a GET request to status-updates-portal.example/px.gif with the uid= tracking parameter, timestamped shortly after the simulated email delivery.
- Test 3Bulk Freemail Sender Recon Email Without Tracking Token (Negative Control)
Expected signal: EmailEvents record with AttachmentCount=0, UrlCount=0; no EmailUrlInfo record for this NetworkMessageId.
References (5)
- https://attack.mitre.org/techniques/T1598/002/
- https://attack.mitre.org/techniques/T1598/003/
- https://www.proofpoint.com/us/blog/threat-insight
- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/advanced-hunting-emailurlinfo-table
- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/advanced-hunting-emailevents-table
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-PretextingReconEmailTrackingBeacon — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month