Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-VishingPretextEmailFollowup.
Upgrade to ProDetect Low-Signal Pretext Email Followed by Voice Phishing Call to Same Target in Elastic Security
Ahead of a voice-phishing (vishing) attempt, actors frequently send a low-signal reconnaissance or spearphishing-link email to a target employee — often themed as an IT helpdesk notice, password-expiry warning, VPN access request, or service-desk ticket confirmation — that by itself carries little malicious payload (no attachment, a benign or absent link, generic wording) and is easily missed by content-based email filtering. The email's real purpose is to prime the target and establish a plausible pretext ('I'm following up on the ticket I just emailed you about') before the actor places a phone call posing as IT support, a vendor, or a colleague to harvest credentials, MFA codes, or internal information directly from the target. Because neither artifact alone is highly suspicious — a generic IT-themed email and an inbound support call are both routine — the highest-fidelity signal is the temporal correlation between the two: the same recipient receiving a pretext-themed email and then being the subject of an inbound call logged in the PBX/UC platform or a new/updated ticketing-system entry referencing them, within a short window (typically under two hours). Detection focuses on three pillars: (1) identifying low-signal, pretext-themed inbound email to a recipient, (2) correlating that recipient with an inbound call record in PBX/UC/telephony logs shortly afterward, and (3) correlating with a helpdesk/ticketing-system entry created or updated for the same user in the same window, since actors sometimes have the (socially engineered) helpdesk agent open the ticket rather than placing the call themselves.
MITRE ATT&CK
- Tactic
- Reconnaissance
Elastic Detection Query
sequence by user.email with maxspan=2h
[email where event.category == "email" and
email.attachments.file.size == null and
(email.subject : ("*helpdesk*", "*help desk*", "*password reset*", "*vpn access*", "*account verification*", "*service desk*"))
]
[network where event.category == "network" and event.dataset == "pbx.call" and network.direction == "inbound"]Sequence-based Elastic EQL detection correlating a low-signal, pretext-themed email (no attachment) with a subsequent inbound PBX/UC call event for the same user within a two-hour window, using a custom pbx.call dataset ingested from the telephony platform.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate helpdesk notification-then-callback workflows for genuine support issues
- Coincidental unrelated inbound calls landing within the correlation window
- Outsourced MSP support ticket-confirmation-then-call sequences that are expected and routine
Other platforms for THREAT-Recon-VishingPretextEmailFollowup
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Low-Signal Pretext Email with No Attachment and Zero URLs
Expected signal: EmailEvents record with Subject containing 'Service Desk Ticket Confirmation' and 'Password Reset', AttachmentCount=0, UrlCount=0, from a sender display name/domain matching helpdesk-themed keywords.
- Test 2Simulated Inbound PBX Call Record Correlated to the Pretext Email Recipient
Expected signal: A synthetic PBX call-log JSON line simulating an inbound call to [email protected] — in a real environment this would be ingested into the SIEM's PBXCallLog_CL-equivalent custom table.
- Test 3Simulated Ticketing-System Password Reset Correlated to the Pretext Email Recipient
Expected signal: A synthetic ticketing-audit JSON line simulating a PasswordReset action for [email protected] — in a real environment this would be ingested into the SIEM's ServiceDeskAudit_CL-equivalent table.
References (5)
- https://attack.mitre.org/techniques/T1598/004/
- https://attack.mitre.org/tactics/TA0043/
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
- https://www.mandiant.com/resources/blog/unc3944-sms-phishing-sim-swapping-ransomware
- https://www.crowdstrike.com/blog/scattered-spider-social-engineering-tactics/
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-VishingPretextEmailFollowup — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month