Trusted Design
Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.
Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).(Citation: Microsoft OAuth Spam 2022)(Citation: Palo Alto Unit 42 VBA Infostealer 2014) Another way to accomplish this is by Email Spoofing(Citation: Proofpoint-spoof) the identity of the sender, which can be used to fool both the human recipient as well as automated security tools,(Citation: cyberproof-double-bounce) or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., "thread hijacking").(Citation: phishing-krebs)
Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,(Citation: sygnia Luna Month)(Citation: CISA Remote Monitoring and Management Software) or install adversary-accessible remote management tools onto their computer (i.e., User Execution).(Citation: Unit42 Luna Moth)
T1566「Phishing」（フィッシング） は、ユーザーを騙して悪意のある活動（マルウェアの実行、認証情報の提供など）を行わせるために、不正なメッセージを送信する初期侵入手法です。
この手法で攻撃者は、「人間の心理的隙（ソーシャルエンジニアリング）を突いた組織内への侵入」を実現します。
フィッシングは、その対象や配信手段によって以下の3つのサブテクニックに分かれます。
技術的な「検知」と、人間の「教育」という両輪の対策が必要です。
フィッシング自体は「騙し」の行為ですが、リンクをクリックしたりファイルを開いたりした際に、以下の脆弱性が悪用されることが多いです。
フィッシングは、攻撃者が「最も安価で、かつ最も成功率が高い」と考える手法です。どれだけ高価なセキュリティ製品を導入しても、最終的には「一人のユーザーのクリック」が組織全体の侵害に繋がるため、エンドポイント保護（EDR）による「侵入後の早期検知」が極めて重要になります。
この攻撃手法を利用する脅威アクターは登録されていません。