القائمة
Adversaries may use voice communications to ultimately gain access to victim systems.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1566-004-spearphishing-voiceيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
عرض SKILL.md
استنادا إلى تصنيف SOC المهني
| name | T1566.004_spearphishing-voice |
| description | Adversaries may use voice communications to ultimately gain access to victim systems. |
| category | input-validation |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1566.004","initial-access","linux","macos","windows","identity-provider","sub-technique"] |
| technique_id | T1566.004 |
| tactic | initial-access |
| all_tactics |
| ["initial-access"] |
| platforms | ["Linux","macOS","Windows","Identity Provider"] |
| mitre_url | https://attack.mitre.org/techniques/T1566/004 |
| tech_stack | ["linux","macos","windows","identity"] |
| cwe_ids | ["CWE-20"] |
| chains_with | ["T1566","T1566.001","T1566.002","T1566.003"] |
| prerequisites | ["T1566"] |
| severity_boost | {"T1566":"Chain with T1566 for deeper attack path","T1566.001":"Chain with T1566.001 for deeper attack path","T1566.002":"Chain with T1566.002 for deeper attack path"} |
Sub-technique of: T1566
Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient.
All forms of phishing are electronically delivered social engineering. In this scenario, adversaries are not directly sending malware to a victim vice relying on User Execution for delivery and execution. For example, victims may receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware, or install adversary-accessible remote management tools (Remote Access Tools) onto their computer.
Adversaries may also combine voice phishing with Multi-Factor Authentication Request Generation in order to trick users into divulging MFA credentials or accepting authentication prompts.
Platforms: Linux, macOS, Windows, Identity Provider
Identify Attack Surface: Determine if the target environment is susceptible to Spearphishing Voice by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1566.004 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
Users can be trained to identify and report social engineering techniques and spearphishing attempts, while also being suspicious of and verifying the identify of callers.
| Finding | Severity | Impact |
|---|---|---|
| Spearphishing Voice technique applicable | High | Initial Access |
| CWE ID | Title |
|---|---|
| CWE-20 | Improper Input Validation |
