T1566.001Initial Access
Spearphishing Attachment
Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted…
CVEs9
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.8
Reports1
Detections
24 Sigma rules tagged T1566.001Spearphishing AttachmentT1566.00124 general rules
- Droppers Exploiting CVE-2017-11882criticalstable
- Ursnif Malware C2 URL Patterncriticalstable
- Exploit for CVE-2017-8759criticaltest
- Suspicious Double Extension File Executionhighstable
- HTML Help HH.EXE Suspicious Child Processhightest
- ISO File Created Within Temp Foldershightest
- Office Macro File Creation From Suspicious Processhightest
- Password Protected ZIP File Opened (Email Attachment)hightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Spearphishing Attachment
9 CVEs, by priority. Each link shows its badge.- CVE-2017-11882Microsoft Office Memory Corruption VulnerabilityMicrosoft · OfficeKEVRansomwarePublic exploitHigh · 7.8T1566.001Spearphishing AttachmentT1059Command and Scripting Interpreter13 reportsMITRE CTID mapping of the KEV entry · how it is exploited99.9%Top 0.03%88.5priority
- CVE-2023-2868Barracuda Networks ESG Appliance Improper Input Validation VulnerabilityBarracuda Networks · Email Security Gateway (ESG) ApplianceKEVPublic exploitCritical · 9.8T1566.001Spearphishing AttachmentT1059Command and Scripting Interpreter+2 moreMITRE CTID mapping of the KEV entry · how it is exploited86.8%Top 0.26%69.8priority
- CVE-2025-33053Microsoft Windows External Control of File Name or Path VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 8.8T1566.001Spearphishing AttachmentT1059Command and Scripting Interpreter+3 moreMITRE CTID mapping of the KEV entry · how it is exploited87.0%Top 0.25%69.1priority
- CVE-2025-04117-Zip Mark of the Web Bypass VulnerabilityMITRE CTID mapping of the KEV entry · how it is exploited67.1%Top 0.7%67.8priority
- CVE-2025-66376Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting VulnerabilitySynacor · Zimbra Collaboration Suite (ZCS)KEVMedium · 6.1T1566.001Spearphishing AttachmentT1059.007JavaScriptAI mapping from the description · how it is exploited20.2%Top 2.5%66.8priority
- CVE-2022-41033Microsoft Windows COM+ Event System Service Privilege Escalation VulnerabilityMicrosoft · Windows COM+ Event System ServiceKEVHigh · 7.8T1566.001Spearphishing AttachmentT1068Exploitation for Privilege EscalationMITRE CTID mapping of the KEV entry · how it is exploited1.9%Top 21%59.4priority
- CVE-2013-0640Adobe Reader and Acrobat Memory Corruption VulnerabilityAdobe · Reader and AcrobatKEVPublic exploitEnd of lifeHigh · 7.8T1566.001Spearphishing Attachment1 reportMITRE CTID mapping of the KEV entry · how it is exploited86.9%Top 0.25%57.3priority
- CVE-2017-11292Adobe Flash Player Type Confusion VulnerabilityAdobe · Flash PlayerKEVEnd of lifeHigh · 8.8T1566.001Spearphishing AttachmentT1204.002Malicious File+2 moreMITRE CTID mapping of the KEV entry · how it is exploited11.9%Top 3.9%48.4priority
- CVE-2020-3133Cisco Email Security Appliance Content Filter Bypass VulnerabilityCisco · Cisco Email Security Appliance (ESA)Medium · 5.8T1566.001Spearphishing AttachmentT1190Exploit Public-Facing ApplicationMITRE CTID mapping of the CVE · how it is exploited1.4%Top 28%18.5priority