t1566-003-spearphishing-via-service

name	T1566.003_spearphishing-via-service
description	Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems.
category	input-validation
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1566.003","initial-access","linux","macos","windows","sub-technique"]
technique_id	T1566.003
tactic	initial-access
all_tactics	["initial-access"]
platforms	["Linux","macOS","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1566/003
tech_stack	["linux","macos","windows"]
cwe_ids	["CWE-20"]
chains_with	["T1566","T1566.001","T1566.002","T1566.004"]
prerequisites	["T1566"]
severity_boost	{"T1566":"Chain with T1566 for deeper attack path","T1566.001":"Chain with T1566.001 for deeper attack path","T1566.002":"Chain with T1566.002 for deeper attack path"}

T1566.003 Spearphishing via Service

Sub-technique of: T1566

High-Level Description

Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.

All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries will create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and software that's running in an environment. The adversary can then send malicious links or attachments through these services.

A common example is to build rapport with a target via social media, then send content to a personal webmail service that the target uses on their work computer. This allows an adversary to bypass some email restrictions on the work account, and the target is more likely to open the file since it's something they were expecting. If the payload doesn't work as expected, the adversary can continue normal communications and troubleshoot with the target on how to get it working.

Kill Chain Phase

• Initial Access (TA0001)

Platforms: Linux, macOS, Windows

What to Check

• Identify if Spearphishing via Service technique is applicable to target environment
• Check Linux systems for indicators of Spearphishing via Service
• Check macOS systems for indicators of Spearphishing via Service
• Check Windows systems for indicators of Spearphishing via Service
• Verify mitigations are bypassed or absent (5 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to Spearphishing via Service by examining the target platforms (Linux, macOS, Windows).