splunk-security_content/stories/spearphishing_attachments.yml

name: Spearphishing Attachments
id: 57226b40-94f3-4ce5-b101-a75f67759c27
version: 1
date: '2019-04-29'
author: Splunk Research Team, Splunk
description: Detect signs of malicious payloads that may indicate that your environment
  has been breached via a phishing attack.
narrative: 'Despite its simplicity, phishing remains the most pervasive and dangerous
  cyberthreat. In fact, research shows that as many as [91% of all successful attacks](https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing)
  are initiated via a phishing email. \

  As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/),
  familiar contact names inserted as senders, and other tactics to lure targets into
  clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/),
  or entering sensitive personal information that perpetrators may intercept. This
  attack technique requires a relatively low level of skill and allows adversaries
  to easily cast a wide net. Worse, because its success relies on the gullibility
  of humans, it''s impossible to completely "automate" it out of your environment.
  However, you can use ES and ESCU to detect and investigate potentially malicious
  payloads injected into your environment subsequent to a phishing attack. \

  While any kind of file may contain a malicious payload, some are more likely to
  be perceived as benign (and thus more often escape notice) by the average victim—especially
  when the attacker sends an email that seems to be from one of their contacts. An
  example is Microsoft Office files. Most corporate users are familiar with documents
  with the following suffixes: .doc/.docx (MS Word), .xls/.xlsx (MS Excel), and .ppt/.pptx
  (MS PowerPoint), so they may click without a second thought, slashing a hole in
  their organizations'' security. \

  Following is a typical series of events, according to an [article by Trend Micro](https://blog.trendmicro.com/trendlabs-security-intelligence/rising-trend-attackers-using-lnk-files-download-malware/):\

  1. Attacker sends a phishing email. Recipient downloads the attached file, which
  is typically a .docx or .zip file with an embedded .lnk file\

  1. The .lnk file executes a PowerShell script\

  1. Powershell executes a reverse shell, rendering the exploit successful </ol>As
  a side note, adversaries are likely to use a tool like Empire to craft and obfuscate
  payloads and their post-injection activities, such as [exfiltration, lateral movement,
  and persistence](https://github.com/EmpireProject/Empire).\

  This Analytic Story focuses on detecting signs that a malicious payload has been
  injected into your environment. For example, one search detects outlook.exe writing
  a .zip file. Another looks for suspicious .lnk files launching processes.'
references:
- https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html
tags:
  analytic_story: Spearphishing Attachments
  category:
  - Adversary Tactics
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  usecase: Advanced Threat Detection