Skip to content
Sign In
Learn

T1566.002

Spearphishing Link

What it is

Attackers send a targeted email with a link that leads to a fake sign-in page, a file download or a page that attacks the browser. It is a sub-technique of Phishing, under the Initial Access tactic. Links avoid many attachment filters, and a convincing message aimed at one person or team is still one of the most common ways intrusions begin.

How adversaries use it

The attacker researches the target, writes a message that fits their work, and links to a site they control, often on a newly registered or look-alike domain, or on a legitimate file sharing service. When the person clicks, the site collects their password, delivers a file, or both. Stolen passwords are then used to sign in to email or remote access.

Detect it in Elastic

Data source: Email gateway and mail service logs; web proxy or DNS logs (vendor-specific, mapped to ECS)

Key fields

email.from.address: who the message claims to be from email.to.address: who received it email.subject: the message's subject line url.full and url.domain: the link, in email logs that record links, and the site visited, in proxy logs user.name and source.ip: in proxy logs, who clicked and from which host event.action: whether the gateway delivered or blocked the message @timestamp

Example event

{
  "url": {
    "full": "https://sharelnk-portal.example/v/q7731",
    "domain": "sharelnk-portal.example"
  },
  "email": {
    "to": {
      "address": "m.castell@corp.example"
    },
    "from": {
      "address": "notices@sharelnk-portal.example"
    },
    "subject": "Revised floor allocation for Q3"
  },
  "event": {
    "category": [
      "email"
    ]
  },
  "@timestamp": "2026-06-09T07:52:19.480Z"
}

Prebuilt Elastic rule: M365 Threat Intelligence Signal

Hunt guidance

Field names depend on the email and proxy products, so check your data view first. Start with delivered messages whose links point to domains your organization has never visited, then join them to proxy logs to see who clicked. Look for look-alike domains, newly registered domains, one sender reaching several people in the same team, and a click followed within minutes by a sign-in from an address the person has never used. The prebuilt rule named on this page is a Microsoft 365 building block, so it fires only when Microsoft 365 data is collected.

Ruling out legitimate activity

Newsletters, marketing tools and legitimate file sharing all send links to unfamiliar domains every day. Check the sender's history with your organization, whether the domain imitates one you use, and what happened after the click. A click followed by a password prompt on a domain you don't use is the case to chase.

Telemetry needed

The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.

References

Practice it

No range covers this technique yet; the write-up above landed first. Ranges are added continuously; the ones live today are on the training ladder.