Spearphishing Attachment
Subtechnique · ATTACK:enterprise:T1598.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1598.002",
"title": "Spearphishing Attachment",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1598/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--8982a661-d84c-48c0-b4ec-1db29c6cf3bc",
"external_id": "T1598.002",
"domain": "enterprise",
"created": "2020-10-02T17:08:57.386Z",
"modified": "2025-10-24T17:49:04.751Z",
"version": "1.2",
"aliases": [
],
"tactics": [
"reconnaissance"
],
"source_references": [
{
"source_name": "ACSC Email Spoofing",
"url": "https://web.archive.org/web/20210708014107/https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf"
},
{
"source_name": "Sophos Attachment",
"url": "https://nakedsecurity.sophos.com/2020/10/02/serious-security-phishing-without-links-when-phishers-bring-along-their-own-web-pages/"
},
{
"source_name": "Huntress HTML Smuggling 2024",
"url": "https://www.huntress.com/blog/smugglers-gambit-uncovering-html-smuggling-adversary-in-the-middle-tradecraft"
},
{
"source_name": "Microsoft Anti Spoofing",
"url": "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide"
},
{
"source_name": "GitHub Phishery",
"url": "https://github.com/ryhanson/phishery"
}
]
}Explicit source assertions (7)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1598.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6385d0af-765c-44f9-afab-ed3852f6a22f
US-CERT TA18-074AATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1598.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b02e229-c01f-47d0-8f37-03871ef0a608
CISA Star Blizzard Advisory December 2023 · Microsoft Star Blizzard August 2022 · StarBlizzard · Google TAG COLDRIVER January 2024ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1598.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a28e6ec8-0519-40e7-b252-90205dfbe5d9
ATT Sidewinder January 2021 · Rewterz Sidewinder APT April 2020 · Cyble Sidewinder September 2020ATTACK:enterprise:T1598.002 → subtechnique-of → ATTACK:enterprise:T1598
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2dc6f64-0980-4668-957d-a09538074898
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1598.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a581fb2c-604a-4417-b782-cafd76b11c37
ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1598.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cfdd9ee1-119f-4071-8498-02bb568fc778
MalwareBytes SideCopy Dec 2021ATTACK:enterprise:M1054 → mitigates → ATTACK:enterprise:T1598.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fe67405d-7fa3-4053-b52c-25dbd4ef3479
ACSC Email Spoofing · Microsoft Anti Spoofing