MITRE ATT&CK technique

Phishing for Information detection rulesT1598

Phishing for Information (T1598) is a MITRE ATT&CK technique in the Reconnaissance tactic. This page lists the 1 community-maintained Sigma detection rule in the library mapped to T1598 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows.

T1598 on attack.mitre.org1 rule

Tactic

Reconnaissance

HTML File Opened From Download Folder
low
Detects web browser process opening an HTML file from a user's Downloads folder. This behavior is could be associated with phishing attacks where threat actors send HTML attachments to users. When a user opens such an attachment, it can lead to the execution of malicious scripts or the download of malware. During investigation, analyze the HTML file for embedded scripts or links, check for any subsequent downloads or process executions, and investigate the source of the email or message containing the attachment.
windows · process_creation

Top products

Tactic

HTML File Opened From Download Folder