Phishing

What is Phishing?

“Phishing is documented as technique T1566 in MITRE ATT&CK® v19.1 under the Initial Access tactic. Detection requires visibility into SIEM, Firewall telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Phishing activity. These methods apply across SIEM, Firewall environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor email gateway logs for messages with mismatched sender display names and actual email addresses, paying particular attention to domain typosquatting patterns such as substituting similar-looking characters.

2. 2

   Analyze URL click patterns in email security tools and proxy logs for newly registered domains, domains with low reputation scores, or domains that redirect through multiple hops before reaching a final destination.

3. 3

   Inspect email attachments for macro-enabled Office documents, password-protected archives, and double-extension files that are commonly used to bypass basic file type filters in email security gateways.

4. 4

   Correlate user authentication events with phishing simulation data and email delivery timestamps to identify accounts that may have submitted credentials to harvesting pages shortly after receiving suspicious messages.

5. 5

   Deploy honeypot email addresses in the corporate directory and alert on any messages delivered to those addresses, which provides high-fidelity signals of active phishing campaigns targeting the organization.

6. 6

   Review DNS query logs for domains queried immediately after suspicious email delivery, focusing on domains registered within the past 30 days or those using dynamic DNS providers frequently abused by threat actors.

Example Alerts

These realistic alert examples show what Phishing looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Phishing?

Detection centers on SIEM, Firewall telemetry for the initial access phase of the attack. Monitor email gateway logs for messages with mismatched sender display names and actual email addresses, paying particular attention to domain typosquatting patterns such as substituting similar-looking characters. Analyze URL click patterns in email security tools and proxy logs for newly registered domains, domains with low reputation scores, or domains that redirect through multiple hops before reaching a final destination.

What does a Phishing alert look like?

A representative SIEM detection is "Suspicious Email Link Click - Credential Harvesting Site" (high severity): User jsmith@corp.com clicked a URL in an email that redirected through three domains before landing on a page mimicking the corporate Office 365 login portal. The final destination domain was registered 2 days ago and has no prior reputation history in threat intelligence feeds.

Which tools detect Phishing, and how can I practice?

Phishing (T1566) is best surfaced with SIEM, Firewall telemetry, which exposes the initial access signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.