Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1566.001

Spearphishing Attachment

Initial Access 80 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Suspicious Execution via Microsoft Office Add-Ins production 2026-10-06
elastic Potential FileFix Command via Windows Explorer Address Bar production 2026-10-05
elastic Potential Execution via FileFix Phishing Attack production 2026-09-28
splunk Windows Defender ASR Rules Stacking production 2026-09-22
splunk Windows Defender ASR Block Events production 2026-09-22
splunk Windows Defender ASR Audit Events production 2026-09-22
elastic Suspicious Explorer Child Process production 2026-09-18
elastic Suspicious MS Office Child Process production 2026-09-18
elastic Windows Script Interpreter Executing Process via WMI production 2026-09-18
elastic Windows Script Executing PowerShell production 2026-09-18
elastic Potential CVE-2025-33053 Exploitation production 2026-09-18
elastic Suspicious MS Outlook Child Process production 2026-09-18
elastic Remote Desktop File Opened from Suspicious Path production 2026-09-18
elastic Suspicious Execution from INET Cache production 2026-09-18
elastic Suspicious HTML File Creation production 2026-09-18
elastic Potential Fake CAPTCHA Phishing Attack production 2026-09-18
elastic Suspicious PDF Reader Child Process production 2026-09-18
elastic Execution of File Written or Modified by Microsoft Office production 2026-09-18
elastic Unusual Execution via Microsoft Common Console File production 2026-09-18
elastic Potential Foxmail Exploitation production 2026-09-18
elastic Downloaded URL Files production 2026-09-18
elastic Downloaded Shortcut Files production 2026-09-18
elastic Network Traffic to Rare Destination Country production 2026-09-18
elastic Suspicious macOS MS Office Child Process production 2026-09-18
elastic Unusual Network Destination Domain Name production 2026-09-18
splunk Windows CAB File on Disk production 2026-08-24
elastic Deprecated - M365 Security Compliance Email Reported by User as Malware or Phish deprecated 2026-08-13
splunk Windows Spearphishing Attachment Connect To None MS Office Domain production 2026-05-13
splunk Windows Phishing PDF File Executes URL Link production 2026-05-13
splunk Email Attachments With Lots Of Spaces experimental 2026-05-13
splunk Suspicious Email Attachment Extensions experimental 2026-05-13
splunk GSuite Email Suspicious Attachment production 2026-05-13
splunk Gsuite Email Suspicious Subject With Attachment production 2026-05-13
splunk Gsuite Email With Known Abuse Web Service Link production 2026-05-13
splunk Gsuite Suspicious Shared File Name experimental 2026-05-13
splunk O365 Email Reported By Admin Found Malicious production 2026-05-13
splunk O365 Email Reported By User Found Malicious production 2026-05-13
splunk O365 Safe Links Detection production 2026-05-13
splunk O365 Threat Intelligence Suspicious Email Delivered production 2026-05-13
splunk O365 ZAP Activity Detection production 2026-05-13
splunk Detect Outlook exe writing a zip file production 2026-05-13
splunk Windows ISO LNK File Creation production 2026-05-13
splunk Windows Office Product Dropped Cab or Inf File production 2026-05-13
splunk Windows Office Product Dropped Uncommon File production 2026-05-13
splunk Windows Office Product Loaded MSHTML Module production 2026-05-13
splunk Windows Office Product Loading Taskschd DLL production 2026-05-13
splunk Windows Office Product Loading VBE7 DLL production 2026-05-13
splunk Windows Office Product Spawned Child Process For Download production 2026-05-13
splunk Windows Office Product Spawned Control production 2026-05-13
splunk Windows Office Product Spawned MSDT production 2026-05-13
splunk Windows Office Product Spawned Rundll32 With No DLL production 2026-05-13
splunk Windows Office Product Spawned Uncommon Process production 2026-05-13
splunk Windows Phishing Recent ISO Exec Registry production 2026-05-13
splunk Windows Spearphishing Attachment Onenote Spawn Mshta production 2026-05-13
splunk Windows Universal Data Link File Creation production 2026-05-13
elastic Deprecated - Execution of File Written or Modified by PDF Reader deprecated 2026-02-04
sigma Suspicious Email Delivered In Microsoft 365 experimental 2026-01-27
sigma Office Macro File Creation test 2026-01-09
sigma HTML File Opened From Download Folder experimental 2025-12-05
sigma Office Macro File Download test 2025-10-29
sigma Suspicious File Created in Outlook Temporary Directory experimental 2025-07-22
sigma Suspicious Double Extension File Execution stable 2025-05-30
sigma Disk Image Mounting Via Hdiutil - MacOS test 2024-08-10
sigma ISO Image Mounted test 2023-11-09
sigma Windows Registry Trust Record Modification test 2023-06-21
sigma Suspicious HH.EXE Execution test 2023-04-12
sigma HTML Help HH.EXE Suspicious Child Process test 2023-04-12
sigma Office Macro File Creation From Suspicious Process test 2023-02-22
sigma Suspicious Microsoft OneNote Child Process test 2023-02-10
sigma Potential Initial Access via DLL Search Order Hijacking test 2022-10-21
sigma Suspicious Execution From Outlook Temporary Folder test 2022-10-09
sigma ISO File Created Within Temp Folders test 2022-07-30
sigma Password Protected ZIP File Opened (Email Attachment) test 2022-05-09
sigma Arbitrary Shell Command Execution Via Settingcontent-Ms test 2022-04-14
sigma ISO or Image Mount Indicator in Recent Files test 2022-02-11
sigma Suspicious HWP Sub Processes test 2021-11-27
sigma Exploit for CVE-2017-0261 test 2021-11-27
sigma Droppers Exploiting CVE-2017-11882 stable 2021-11-27
sigma Exploit for CVE-2017-8759 test 2021-11-27
sigma Ursnif Malware C2 URL Pattern stable 2021-08-09