CAPEC-163: Spear Phishing
Description
An adversary targets a specific user or group with a Phishing (CAPEC-98) attack tailored to a category of users in order to have maximum relevance and deceptive capability. Spear Phishing is an enhanced version of the Phishing attack targeted to a specific user or group. The quality of the targeted email is usually enhanced by appearing to come from a known or trusted entity. If the email account of some trusted entity has been compromised the message may be digitally signed. The message will contain information specific to the targeted users that will enhance the probability that they will follow the URL to the compromised site. For example, the message may indicate knowledge of the targets employment, residence, interests, or other information that suggests familiarity. As soon as the user follows the instructions in the message, the attack proceeds as a standard Phishing attack.
- Likelihood of attack
- High
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Engage in Deceptive Interactions
Prerequisites
- None. Any user can be targeted by a Spear Phishing attack.
Skills required
- MediumSpear phishing attacks require specific knowledge of the victims being targeted, such as which bank is being used by the victims, or websites they commonly log into (Google, Facebook, etc).
Consequences
- Confidentiality
Read Data
Information Leakage
- AccountabilityAuthenticationAuthorizationNon-Repudiation
Gain Privileges
Privilege Escalation
- Integrity
Modify Data
Data Modification
Mitigations
- Do not follow any links that you receive within your e-mails and certainly do not input any login credentials on the page that they take you too. Instead, call your Bank, PayPal, eBay, etc., and inquire about the problem. A safe practice would also be to type the URL of your bank in the browser directly and only then log in. Also, never reply to any e-mails that ask you to provide sensitive information of any kind.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
- T1534Internal Spearphishing
- T1566.001Phishing: Spearphishing Attachment
- T1566.002Phishing: Spearphishing Link
- T1566.003Phishing: Spearphishing via Service
- T1598.001Phishing for Information: Spearphishing Service
- T1598.002Phishing for Information: Spearphishing Attachment
- T1598.003Phishing for Information: Spearphishing Link
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 3 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-EFEmail Filtering2 shared
- D3-RERestore Email2 shared
- D3-SMRASender MTA Reputation Analysis2 shared
- D3-SRASender Reputation Analysis2 shared
- D3-EREmail Removal2 shared
- D3-HDHomoglyph Detection2 shared
- D3-DIData Inventory2 shared
- D3-DADynamic Analysis2 shared
- D3-EFAEmulated File Analysis2 shared
- D3-CFContent Filtering2 shared
- D3-CMContent Modification2 shared
- D3-DFDecoy File2 shared