T1566: Phishing

Framework: MITRE ATT&CK · Tactic: Initial Access · Total Cataloged Families: 6 · Observed Samples: 273 · Primary Threat Categories: Trojan · Trojan Generic · Ransomware

Operational Executive Summary

T1566 (Phishing) is classified under the Initial Access tactic within the MITRE ATT&CK framework. Techniques used by adversaries to gain their initial foothold within an enterprise network, spanning spearphishing, drive-by downloads, exploit kits, and compromised edge perimeter appliances. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 6 distinct malware families, totaling over 273 validated samples.

Technical Anatomy & Adversary Tradecraft

Adversaries leverage Phishing to accomplish operational objectives while minimizing anomalous forensic footprints. When executing Phishing, malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.

In modern multi-stage campaigns, T1566 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute Phishing to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.

Authoritative MITRE ATT&CK Reference: View official technique documentation, sub-techniques, and adversary groups at https://attack.mitre.org/techniques/T1566/.

Detection Engineering & Threat Hunting

Detecting Phishing requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:

Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.

SOC Containment & Hardening Guidance

To mitigate risks associated with T1566 (Phishing) across production infrastructure, security teams should implement the following defensive controls:

Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing Phishing across adjacent network segments.

→ Incident Response Guidance: Read our Active Incident Response Playbook

Cataloged Malware Families Utilizing T1566 (6 Families)

The following malware families in the SystemHelpDesk catalog have been verified utilizing T1566 (Phishing):

6 families

Family	Category	Sample Count	Technical Summary
hosts	Trojan Generic	`267`	BrowserModifier:Win32/Hosts (or simply 'Hosts file hijacker') is a generic heuristic detection for malware or adware that maliciously modifies the Windows HOSTS...
habbo	Trojan	`2`	Trojan:Win32/Habbo (or HackTool:Win32/Habbo) is a highly specialized threat designed specifically to target users of 'Habbo Hotel', a massive online virtual com...
yabinder	Ransomware	`2`	HackTool:Win32/Yabinder is a utility program used maliciously by threat actors to combine (or 'bind') multiple executable files into a single, seamless executab...
adanti	Trojan	`1`	Adanti (classified in antivirus detection telemetry under designations including Trojan:Win32/Adanti, Trojan.Win32.Adanti, and Win32/Adanti) is a multi-stage tr...
sharer	Trojan	`1`	<h3>Executive Summary</h3> Sharer (often detected as Worm.P2P.Sharer or Trojan.Sharer) represents a family of legacy worms specifically engineered to exploit th...
bozok	Trojan	`Sampled`	Bozok is a highly capable Remote Access Trojan (RAT) that first appeared on cybercriminal forums around 2015. Developed in Delphi, Bozok is designed with stealt...