Initial Access Lateral Movement AML.T0052

Phishing

Description

Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.

Generative AI, including LLMs that generate synthetic text, visual deepfakes of faces, and audio deepfakes of speech (See Generate Deepfakes), is enabling adversaries to scale targeted phishing campaigns (See Spearphishing via Social Engineering LLM). LLMs can interact with users via text conversations and can be programmed with a system prompt to phish for sensitive information. Deepfakes can also be used in Impersonation as an aid to phishing.

ATLAS ID: AML.T0052
Maturity: RealizedUsed by real adversaries against AI systems in the wild.
Platforms: Enterprise

Sub-techniques

Mitigations

AML.M0018User Training
Train users to identify phishing attempts by an adversary to reduce the risk of successful spearphishing, social engineering, and other techniques that involve user interaction.
AML.M0034Deepfake Detection
Deepfake detection can be used to identify and block phishing attempts that use generated content.

Case studies that use it

Related ATT&CK technique

ATLAS adapts this technique from MITRE ATT&CK Enterprise.

T1566Phishing

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

22 more in the full list