Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-VishingPretextEmailFollowup.
Upgrade to ProDetect Low-Signal Pretext Email Followed by Voice Phishing Call to Same Target in Splunk
Ahead of a voice-phishing (vishing) attempt, actors frequently send a low-signal reconnaissance or spearphishing-link email to a target employee — often themed as an IT helpdesk notice, password-expiry warning, VPN access request, or service-desk ticket confirmation — that by itself carries little malicious payload (no attachment, a benign or absent link, generic wording) and is easily missed by content-based email filtering. The email's real purpose is to prime the target and establish a plausible pretext ('I'm following up on the ticket I just emailed you about') before the actor places a phone call posing as IT support, a vendor, or a colleague to harvest credentials, MFA codes, or internal information directly from the target. Because neither artifact alone is highly suspicious — a generic IT-themed email and an inbound support call are both routine — the highest-fidelity signal is the temporal correlation between the two: the same recipient receiving a pretext-themed email and then being the subject of an inbound call logged in the PBX/UC platform or a new/updated ticketing-system entry referencing them, within a short window (typically under two hours). Detection focuses on three pillars: (1) identifying low-signal, pretext-themed inbound email to a recipient, (2) correlating that recipient with an inbound call record in PBX/UC/telephony logs shortly afterward, and (3) correlating with a helpdesk/ticketing-system entry created or updated for the same user in the same window, since actors sometimes have the (socially engineered) helpdesk agent open the ticket rather than placing the call themselves.
MITRE ATT&CK
- Tactic
- Reconnaissance
SPL Detection Query
search index=email sourcetype="o365:management:activity" Operation="MailItemsAccessed" OR Operation="Send"
| eval PretextKeywords="helpdesk|help desk|it support|service desk|password expir|password reset|vpn access|account verification|ticket confirmation|technical support|account suspended|mfa re-enrollment"
| where match(lower(Subject), PretextKeywords) OR match(lower(SenderDisplayName), PretextKeywords)
| where AttachmentCount=0 AND UrlCount<=1
| eval EmailTimestamp=_time
| join type=inner RecipientEmailAddress
[ search index=telephony sourcetype="pbx:call:log" CallDirection="Inbound"
| rename TargetUserPrincipalName as RecipientEmailAddress, _time as CallTimestamp
| fields RecipientEmailAddress, CallTimestamp, CallerNumber, CallDurationSeconds ]
| eval MinutesBetweenEmailAndCall=round((CallTimestamp - EmailTimestamp)/60, 1)
| where MinutesBetweenEmailAndCall >= 0 AND MinutesBetweenEmailAndCall <= 120
| eval CorrelationSource="PBXCallLog"
| table EmailTimestamp, CallTimestamp, MinutesBetweenEmailAndCall, RecipientEmailAddress, SenderFromAddress, Subject, CallerNumber, CallDurationSeconds, CorrelationSource
| append
[ search index=email sourcetype="o365:management:activity" Operation="MailItemsAccessed" OR Operation="Send"
| eval PretextKeywords="helpdesk|help desk|it support|service desk|password expir|password reset|vpn access|account verification|ticket confirmation|technical support|account suspended|mfa re-enrollment"
| where match(lower(Subject), PretextKeywords) OR match(lower(SenderDisplayName), PretextKeywords)
| where AttachmentCount=0 AND UrlCount<=1
| eval EmailTimestamp=_time
| join type=inner RecipientEmailAddress
[ search index=servicedesk sourcetype="ticketing_audit" Action IN ("TicketCreated","TicketUpdated","PasswordReset","MFAReset")
| rename User as RecipientEmailAddress, _time as TicketTimestamp
| fields RecipientEmailAddress, TicketTimestamp, Agent, Action ]
| eval MinutesBetweenEmailAndCall=round((TicketTimestamp - EmailTimestamp)/60, 1)
| where MinutesBetweenEmailAndCall >= 0 AND MinutesBetweenEmailAndCall <= 120
| eval CorrelationSource="ServiceDeskTicket", CallerNumber=Agent
| table EmailTimestamp, TicketTimestamp, MinutesBetweenEmailAndCall, RecipientEmailAddress, SenderFromAddress, Subject, CallerNumber, CorrelationSource ]
| sort - EmailTimestampTwo-source SPL correlation joining low-signal pretext-themed email events (Office 365 Management Activity mail events with no attachment and at most one URL) against PBX/UC telephony call logs and ticketing-system audit records for the same recipient within a 120-minute window. Requires the organization's PBX/UC platform and helpdesk ticketing system to be onboarded as Splunk indexes (telephony and servicedesk respectively) via their own forwarders or add-ons.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate helpdesk-initiated notification campaigns followed by an expected employee callback to the real service desk
- Coincidental unrelated inbound personal calls landing within the correlation window for a recipient of a routine IT email
- Outsourced MSP support workflows where an automated ticket-confirmation email is a standard, expected precursor to a callback
- New-hire onboarding email and helpdesk-call sequences that are a normal part of account setup
- Authorized internal vishing-simulation exercises pairing a test pretext email with a scheduled test call
Other platforms for THREAT-Recon-VishingPretextEmailFollowup
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Low-Signal Pretext Email with No Attachment and Zero URLs
Expected signal: EmailEvents record with Subject containing 'Service Desk Ticket Confirmation' and 'Password Reset', AttachmentCount=0, UrlCount=0, from a sender display name/domain matching helpdesk-themed keywords.
- Test 2Simulated Inbound PBX Call Record Correlated to the Pretext Email Recipient
Expected signal: A synthetic PBX call-log JSON line simulating an inbound call to [email protected] — in a real environment this would be ingested into the SIEM's PBXCallLog_CL-equivalent custom table.
- Test 3Simulated Ticketing-System Password Reset Correlated to the Pretext Email Recipient
Expected signal: A synthetic ticketing-audit JSON line simulating a PasswordReset action for [email protected] — in a real environment this would be ingested into the SIEM's ServiceDeskAudit_CL-equivalent table.
References (5)
- https://attack.mitre.org/techniques/T1598/004/
- https://attack.mitre.org/tactics/TA0043/
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
- https://www.mandiant.com/resources/blog/unc3944-sms-phishing-sim-swapping-ransomware
- https://www.crowdstrike.com/blog/scattered-spider-social-engineering-tactics/
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-VishingPretextEmailFollowup — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month