Spearphishing via Social Engineering LLM
Sub-technique of AML.T0052 Phishing
Description
Adversaries may turn LLMs into targeted social engineers.
LLMs are capable of interacting with users via text conversations.
They can be instructed by an adversary to seek sensitive information from a user and act as effective social engineers.
They can be targeted towards particular personas defined by the adversary.
This allows adversaries to scale spearphishing efforts and target individuals to reveal private information such as credentials to privileged systems.
- ATLAS ID
- AML.T0052.000
- Maturity
- DemonstratedShown to work in research or red-team exercises.
- Platforms
- Enterprise
Mitigations
- AML.M0018User Training
Train users to identify phishing attempts and understand that AI can be used to generate targeted and convincing messages.
- AML.M0034Deepfake Detection
Deepfake detection can be used to identify and block phishing attempts that use generated content.
Case studies that use it
Related ATT&CK technique
ATLAS references this ATT&CK technique on the parent technique.
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-EFEmail Filtering1 shared
- D3-IAAIdentifier Activity Analysis1 shared
- D3-RERestore Email1 shared
- D3-SMRASender MTA Reputation Analysis1 shared
- D3-SRASender Reputation Analysis1 shared
- D3-UAURL Analysis1 shared
- D3-URAURL Reputation Analysis1 shared
- D3-EREmail Removal1 shared
- D3-ISVAInbound Session Volume Analysis1 shared
- D3-ITFInbound Traffic Filtering1 shared
- D3-HDHomoglyph Detection1 shared
- D3-DIData Inventory1 shared