Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-VishingPretextEmailFollowup.
Upgrade to ProDetect Low-Signal Pretext Email Followed by Voice Phishing Call to Same Target in IBM QRadar
Ahead of a voice-phishing (vishing) attempt, actors frequently send a low-signal reconnaissance or spearphishing-link email to a target employee — often themed as an IT helpdesk notice, password-expiry warning, VPN access request, or service-desk ticket confirmation — that by itself carries little malicious payload (no attachment, a benign or absent link, generic wording) and is easily missed by content-based email filtering. The email's real purpose is to prime the target and establish a plausible pretext ('I'm following up on the ticket I just emailed you about') before the actor places a phone call posing as IT support, a vendor, or a colleague to harvest credentials, MFA codes, or internal information directly from the target. Because neither artifact alone is highly suspicious — a generic IT-themed email and an inbound support call are both routine — the highest-fidelity signal is the temporal correlation between the two: the same recipient receiving a pretext-themed email and then being the subject of an inbound call logged in the PBX/UC platform or a new/updated ticketing-system entry referencing them, within a short window (typically under two hours). Detection focuses on three pillars: (1) identifying low-signal, pretext-themed inbound email to a recipient, (2) correlating that recipient with an inbound call record in PBX/UC/telephony logs shortly afterward, and (3) correlating with a helpdesk/ticketing-system entry created or updated for the same user in the same window, since actors sometimes have the (socially engineered) helpdesk agent open the ticket rather than placing the call themselves.
MITRE ATT&CK
- Tactic
- Reconnaissance
QRadar Detection Query
SELECT
e."EmailTime" AS EmailTimestamp, c."CallTime" AS CallTimestamp,
e."RecipientEmailAddress", e."Subject", c."CallerNumber",
(c."CallTime" - e."EmailTime") AS SecondsBetween
FROM (
SELECT devicetime AS "EmailTime", "RecipientEmailAddress", "Subject"
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%email%'
AND ("Subject" ILIKE '%helpdesk%' OR "Subject" ILIKE '%password reset%' OR "Subject" ILIKE '%vpn access%' OR "Subject" ILIKE '%service desk%')
LAST 24 HOURS
) e
JOIN (
SELECT devicetime AS "CallTime", "TargetUserPrincipalName" AS "RecipientEmailAddress", "CallerNumber"
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%pbx%' AND "CallDirection" = 'Inbound'
LAST 24 HOURS
) c
ON e."RecipientEmailAddress" = c."RecipientEmailAddress"
WHERE (c."CallTime" - e."EmailTime") BETWEEN 0 AND 7200
ORDER BY e."EmailTime" DESC
LAST 24 HOURSQRadar AQL detection joining pretext-themed email events against inbound PBX call events for the same recipient within a two-hour (7200 second) window, requiring both the email gateway and PBX/UC platform to be onboarded as QRadar log sources.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate helpdesk-initiated notification campaigns followed by an expected employee callback
- Coincidental unrelated inbound calls within the correlation window
- Outsourced MSP ticket-confirmation-then-call workflows
Other platforms for THREAT-Recon-VishingPretextEmailFollowup
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Low-Signal Pretext Email with No Attachment and Zero URLs
Expected signal: EmailEvents record with Subject containing 'Service Desk Ticket Confirmation' and 'Password Reset', AttachmentCount=0, UrlCount=0, from a sender display name/domain matching helpdesk-themed keywords.
- Test 2Simulated Inbound PBX Call Record Correlated to the Pretext Email Recipient
Expected signal: A synthetic PBX call-log JSON line simulating an inbound call to [email protected] — in a real environment this would be ingested into the SIEM's PBXCallLog_CL-equivalent custom table.
- Test 3Simulated Ticketing-System Password Reset Correlated to the Pretext Email Recipient
Expected signal: A synthetic ticketing-audit JSON line simulating a PasswordReset action for [email protected] — in a real environment this would be ingested into the SIEM's ServiceDeskAudit_CL-equivalent table.
References (5)
- https://attack.mitre.org/techniques/T1598/004/
- https://attack.mitre.org/tactics/TA0043/
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
- https://www.mandiant.com/resources/blog/unc3944-sms-phishing-sim-swapping-ransomware
- https://www.crowdstrike.com/blog/scattered-spider-social-engineering-tactics/
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-VishingPretextEmailFollowup — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month