T1566Initial Access
Phishing
Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.…
CVEs27
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.8
Reports2
Detections
14 Sigma rules tagged T1566PhishingT156614 general rules
- CVE-2021-31979 CVE-2021-33771 Exploitscriticaltest
- CVE-2021-31979 CVE-2021-33771 Exploits by Sourgumcriticaltest
- HTML Help HH.EXE Suspicious Child Processhightest
- Okta FastPass Phishing Detectionhightest
- Phishing Pattern ISO in Archivehightest
- Potential Malicious Usage of CloudTrail System Managerhightest
- Suspicious External WebDAV Executionhightest
- Suspicious HH.EXE Executionhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Phishing
27 CVEs, by priority. Each link shows its badge.- CVE-2024-43451Microsoft Windows NTLMv2 Hash Disclosure Spoofing VulnerabilityAI mapping from the description · how it is exploited84.3%Top 0.3%81.4priority
- CVE-2021-40449Microsoft Windows Win32k Privilege Escalation VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1566PhishingT1059.003Windows Command Shell+6 moreMITRE CTID mapping of the KEV entry · how it is exploited81.9%Top 0.35%78.4priority
- CVE-2023-36884Microsoft Windows Search Remote Code Execution VulnerabilityMITRE CTID mapping of the KEV entry · how it is exploited99.4%Top 0.06%78.2priority
- CVE-2025-24054Microsoft Windows NTLM Hash Disclosure Spoofing VulnerabilityMITRE CTID mapping of the KEV entry · how it is exploited62.3%Top 0.82%66.6priority
- CVE-2025-27915Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting VulnerabilitySynacor · Zimbra Collaboration Suite (ZCS)KEVPublic exploitMedium · 5.4T1566PhishingT1059Command and Scripting InterpreterAI mapping from the description · how it is exploited4.1%Top 9.3%64.9priority
- CVE-2022-41128Microsoft Windows Scripting Languages Remote Code Execution VulnerabilityMITRE CTID mapping of the KEV entry · how it is exploited24.6%Top 2.1%63.7priority
- CVE-2022-34713Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityMITRE CTID mapping of the KEV entry · how it is exploited67.8%Top 0.69%63.3priority
- CVE-2024-11182MDaemon Email Server Cross-Site Scripting (XSS) VulnerabilityMITRE CTID mapping of the KEV entry · how it is exploited33.3%Top 1.6%61.9priority
- CVE-2019-15276Cisco Wireless LAN Controller HTTP Parsing Engine Denial of Service VulnerabilityCisco · Cisco Wireless LAN Controller (WLC)Public exploitHigh · 7.7T1190Exploit Public-Facing ApplicationT1566Phishing+1 moreMITRE CTID mapping of the CVE · how it is exploited46.3%Top 1.2%30.2priority
- CVE-2020-3198Cisco IOS Software for Cisco Industrial Routers Arbitrary Code Execution VulnerabilitiesCisco · Cisco IOS 12.2(60)EZ16Critical · 9.8T1133External Remote ServicesT1190Exploit Public-Facing Application+3 moreMITRE CTID mapping of the CVE · how it is exploited4.6%Top 8.4%25.2priority
- CVE-2018-8353A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in…MITRE CTID mapping of the CVE · how it is exploited67.3%Top 0.7%24.9priority
- CVE-2020-1569Microsoft Edge Memory Corruption VulnerabilityMITRE CTID mapping of the CVE · how it is exploited3.0%Top 13%23.6priority
- CVE-2020-3440Cisco Webex Meetings Desktop App for Windows Arbitrary File Overwrite VulnerabilityMITRE CTID mapping of the CVE · how it is exploited2.6%Top 15%23.0priority
- CVE-2019-1772Cisco Webex Network Recording Player Arbitrary Code Execution VulnerabilityMITRE CTID mapping of the CVE · how it is exploited1.7%Top 23%20.9priority
- CVE-2019-0609A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…MITRE CTID mapping of the CVE · how it is exploited9.8%Top 4.4%19.8priority
- CVE-2018-8575A remote code execution vulnerability exists in Microsoft Project software when it fails to properly handle objects in…MITRE CTID mapping of the CVE · how it is exploited19.5%Top 2.6%19.5priority
- CVE-2018-8110A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft…MITRE CTID mapping of the CVE · how it is exploited16.9%Top 2.9%19.4priority
- CVE-2018-8111A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft…MITRE CTID mapping of the CVE · how it is exploited16.9%Top 2.9%19.4priority
- CVE-2019-1831Cisco Email Security Appliance Content Filter Bypass VulnerabilityMITRE CTID mapping of the CVE · follow-on activity1.6%Top 24%19.3priority
- CVE-2018-8160An information disclosure vulnerability exists in Outlook when a message is opened, aka "Microsoft Outlook Information…MITRE CTID mapping of the CVE · how it is exploited8.5%Top 5%19.0priority
- CVE-2020-1495Microsoft Excel Remote Code Execution VulnerabilityMicrosoft · Microsoft SharePoint Server 2010 Service Pack 2T1566PhishingT1204.002Malicious File+6 moreMITRE CTID mapping of the CVE · how it is exploited4.2%Top 9%18.9priority
- CVE-2020-4068Heap-based Buffer Overflow in APNSwiftkylebrowning · APNSwiftMedium · 6.3T1091Replication Through Removable MediaT1133External Remote Services+4 moreMITRE CTID mapping of the CVE · how it is exploited1.3%Top 29%18.6priority
- CVE-2019-1915Multiple Cisco Unified Communications Products Cross-Site Request Forgery VulnerabilityCisco · Cisco Unified Communications ManagerMedium · 6.5T1189Drive-by CompromiseT1566Phishing+3 moreMITRE CTID mapping of the CVE · how it is exploited0.7%Top 48%14.9priority
- CVE-2018-15782DSA-2018-226: RSA® Authentication Manager Relative Path Traversal VulnerabilityMITRE CTID mapping of the CVE · how it is exploited0.4%Top 63%12.7priority
- CVE-2020-3322Cisco Webex Network Recording Player and Cisco Webex Player Denial of Service VulnerabilityMITRE CTID mapping of the CVE · how it is exploited0.7%Top 49%12.6priority
- CVE-2019-1013Windows GDI Information Disclosure VulnerabilityMITRE CTID mapping of the CVE · how it is exploited6.6%Top 6.1%7.7priority
- CVE-2018-15376Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers Arbitrary Memory Write VulnerabilitiesMITRE CTID mapping of the CVE · how it is exploited0.3%Top 74%5.2priority
Linked through a sub-technique
21 more- CVE-2017-11882Microsoft Office Memory Corruption VulnerabilityMicrosoft · OfficeKEVRansomwarePublic exploitHigh · 7.8T1566.001Spearphishing AttachmentT1059Command and Scripting Interpreter13 reports99.9%Top 0.03%88.5priority
- CVE-2018-6882Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) VulnerabilitySynacor · Zimbra Collaboration Suite (ZCS)KEVRansomwarePublic exploitMedium · 6.1T1566.002Spearphishing LinkT1059Command and Scripting Interpreter29.8%Top 1.8%76.9priority
- CVE-2015-5119Adobe Flash Player Use-After-Free VulnerabilityAdobe · Flash PlayerKEVPublic exploitEnd of lifeCritical · 9.8T1566.002Spearphishing LinkT1059.007JavaScript+3 more · 5 reports98.6%Top 0.08%74.8priority
- CVE-2023-2868Barracuda Networks ESG Appliance Improper Input Validation VulnerabilityBarracuda Networks · Email Security Gateway (ESG) ApplianceKEVPublic exploitCritical · 9.8T1566.001Spearphishing AttachmentT1059Command and Scripting Interpreter+2 more86.8%Top 0.26%69.8priority
- CVE-2024-21413Microsoft Outlook Improper Input Validation VulnerabilityMicrosoft · Office OutlookKEVPublic exploitCritical · 9.8T1566.002Spearphishing LinkT1059Command and Scripting Interpreter94.7%Top 0.14%69.8priority
- CVE-2024-42009RoundCube Webmail Cross-Site Scripting VulnerabilityRoundcube · WebmailKEVPublic exploitCritical · 9.3T1566.002Spearphishing LinkT1056Input Capture+1 more82.9%Top 0.33%69.4priority
- CVE-2025-33053Microsoft Windows External Control of File Name or Path VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 8.8T1566.001Spearphishing AttachmentT1059Command and Scripting Interpreter+3 more87.0%Top 0.25%69.1priority
- CVE-2023-2533PaperCut NG/MF Cross-Site Request Forgery (CSRF) VulnerabilityPaperCut · NG/MFKEVPublic exploitHigh · 8.8T1566.002Spearphishing LinkT1059Command and Scripting Interpreter+1 more28.8%Top 1.9%68.8priority
- CVE-2025-04117-Zip Mark of the Web Bypass Vulnerability67.1%Top 0.7%67.8priority
- CVE-2025-66376Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting VulnerabilitySynacor · Zimbra Collaboration Suite (ZCS)KEVMedium · 6.1T1566.001Spearphishing AttachmentT1059.007JavaScript20.2%Top 2.5%66.8priority
- CVE-2024-27443Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) VulnerabilitySynacor · Zimbra Collaboration Suite (ZCS)KEVPublic exploitMedium · 6.1T1566.002Spearphishing LinkT1059.004Unix Shell+2 more24.6%Top 2.1%66.8priority
- CVE-2025-48700Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting VulnerabilitySynacor · Zimbra Collaboration Suite (ZCS)KEVMedium · 6.1T1566.002Spearphishing LinkT1059.007JavaScript+1 more1.7%Top 23%62.7priority
- CVE-2022-41033Microsoft Windows COM+ Event System Service Privilege Escalation VulnerabilityMicrosoft · Windows COM+ Event System ServiceKEVHigh · 7.8T1566.001Spearphishing AttachmentT1068Exploitation for Privilege Escalation1.9%Top 21%59.4priority
- CVE-2013-0640Adobe Reader and Acrobat Memory Corruption VulnerabilityAdobe · Reader and AcrobatKEVPublic exploitEnd of lifeHigh · 7.8T1566.001Spearphishing Attachment1 report86.9%Top 0.25%57.3priority
- CVE-2017-11292Adobe Flash Player Type Confusion VulnerabilityAdobe · Flash PlayerKEVEnd of lifeHigh · 8.8T1566.001Spearphishing AttachmentT1204.002Malicious File+2 more11.9%Top 3.9%48.4priority
- CVE-2019-3778Open Redirect in spring-security-oauth216.6%Top 3%25.5priority
- CVE-2020-3133Cisco Email Security Appliance Content Filter Bypass VulnerabilityCisco · Cisco Email Security Appliance (ESA)Medium · 5.8T1566.001Spearphishing AttachmentT1190Exploit Public-Facing Application1.4%Top 28%18.5priority
- CVE-2019-3788UAA redirect-uri allows wildcard in the subdomain0.8%Top 42%17.6priority
- CVE-2018-11067Dell EMC Avamar and Integrated Data Protection Appliance Open Redirection Vulnerability1.8%Top 21%15.7priority
- CVE-2020-15233OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses0.8%Top 43%15.6priority
- CVE-2020-5270Open redirection when using back parameter of PrestaShop0.8%Top 42%14.4priority
Passages that support these links
**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.
**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.
**VenomKit.** VenomKit is a tool that threat actors can use to craft malicious Rich Text File (RTF) documents that exploit multiple vulnerabilities, including CVE-2017–11882, CVE-2018–0802, and CVE-2018–8174.