| name | conducting-spearphishing-simulation-campaign |
| description | Spearphishing simulation is a targeted social engineering attack vector used by red teams to gain initial access. Unlike broad phishing campaigns, spearphishing uses OSINT-derived intelligence to craf |
| domain | cybersecurity |
| subdomain | red-teaming |
| tags | ["red-team","adversary-simulation","mitre-attack","exploitation","post-exploitation","spearphishing","social-engineering"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| d3fend_techniques | ["File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis"] |
| nist_csf | ["ID.RA-01","GV.OV-02","DE.AE-07"] |
Conducting Spearphishing Simulation Campaign
Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
Overview
Spearphishing simulation is a targeted social engineering attack vector used by red teams to gain initial access. Unlike broad phishing campaigns, spearphishing uses OSINT-derived intelligence to craft highly personalized messages targeting specific individuals. This skill covers developing pretexts, building payloads, setting up email infrastructure, executing the campaign, and tracking results.
When to Use
- When conducting security assessments that involve conducting spearphishing simulation campaign
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Most Often Missed & How to Confirm
- Sending before domain authentication is correct. Missing/incorrect SPF, DKIM, and DMARC alignment lands mail in spam or gets it rejected. Verify all three pass before the first wave.
- No warming/aging of the look-alike domain. Freshly registered domains get category-blocked; age and build reputation (2+ weeks) and submit for categorization.
- Payload never tested against the target's stack. HTML smuggling, ISO/LNK, and OneNote lures must be detonated against the known email gateway + EDR before launch, not on the target.
- Mass-sending instead of waves, which trips volume-based gateway throttling and tips off the SOC.
- Tracking only opens. Opens are noisy (security scanners pre-click); the real signal is credential submission or payload execution.
- How to confirm a hit: the success signal is a tracked credential submission landing in GoPhish/Evilginx (for Evilginx, a captured session cookie that replays past MFA), or a beacon checking in from a target after payload execution. Verify delivery first by sending a seeded test address and confirming inbox placement + DKIM/DMARC pass. Don't conclude a recipient is "safe" on opens alone — confirm whether they submitted creds, executed the payload, or reported the mail to the SOC.
Prerequisites
- Familiarity with red teaming concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
