Phishing (Malicious Attachments)

Overview

Phishing involving malicious attachments is a technique where adversaries deliver harmful files within seemingly legitimate emails or messages to compromise target systems. This method plays a critical role in the initial access and execution phases of the attack lifecycle by exploiting user trust and leveraging file-based payloads to establish footholds or execute malicious code.

Attack Objective

• Gain initial access to target environments or execute malicious code
• Supports Initial Access, Execution, Persistence, and sometimes Privilege Escalation stages
• Advances attacker position by enabling code execution, establishing persistence, or facilitating lateral movement

How the Technique Works

Adversaries craft emails or messages containing attachments that appear benign but harbor malicious content such as scripts, executables, or weaponized documents. When recipients open or interact with these attachments, embedded code executes, often exploiting vulnerabilities or leveraging user privileges to compromise the system and deploy additional payloads.

Common Methods & Variations

• Use of weaponized Office documents (e.g., macros), PDFs, archives, or executable files
• Attachments delivered via on-premises email systems, cloud-based email services, or collaboration platforms
• Employment of living-off-the-land binaries (LOLBins) embedded in attachments versus custom malware payloads

Indicators of Compromise (IOCs)

• Unusual attachment file types or names in email logs
• Execution of unexpected processes or scripts triggered by attachment interaction on endpoints
• Network connections initiated by processes spawned from attachments
• Alerts from email security gateways detecting suspicious attachments

Detection Strategies

• Monitoring email gateway logs and endpoint process creation events
• Behavioral detection focusing on macro execution, script launches, and anomalous file activity
• Correlation of email metadata with endpoint and network telemetry to identify suspicious attachment usage

Mitigation & Prevention

• Implement email filtering and sandboxing to block or analyze attachments
• Enforce policies disabling macros or scripting in documents by default
• User training to recognize phishing attempts and avoid opening unsolicited attachments
• Apply least privilege principles to limit execution capabilities of user accounts

Response Considerations

• Isolate affected systems to prevent lateral movement
• Analyze attachment files and related processes to determine scope and impact
• Remove malicious artifacts and apply patches or configuration changes to prevent recurrence
• Review email logs and endpoint telemetry to identify other potential victims

Related Techniques

• Phishing with embedded links for credential harvesting or malware download
• Use of spearphishing attachments combined with macro execution or exploit payloads
• Follow-on lateral movement and persistence techniques enabled by initial compromise

Mapping & References

• MITRE ATT&CK T1566.001 – Phishing: Spearphishing Attachment
• Public advisories on phishing campaigns utilizing malicious attachments
• Incident reports detailing attachment-based initial access and execution