# T1566 Phishing

MITRE ATT&CK Enterprise v20.0 technique. Tactics: Initial Access. Platforms: Identity Provider, Linux, macOS, Office Suite, SaaS, Windows.

MITRE's description: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.

## NIST SP 800-53 controls in CTID's mapping (13)
- AC-04 Information Flow Enforcement
- CA-07 Continuous Monitoring
- CM-02 Baseline Configuration
- CM-06 Configuration Settings
- IA-09 Service Identification and Authentication
- RA-05 Vulnerability Monitoring and Scanning
- SC-07 Boundary Protection
- SC-20 Secure Name/Address Resolution Service (Authoritative Source)
- SC-44 Detonation Chambers
- SI-02 Flaw Remediation
- SI-03 Malicious Code Protection
- SI-04 System Monitoring
- SI-08 Spam Protection

## OSA patterns that include these controls (48; the 8 with the most)
- SP-028 Secure DevOps Pipeline Pattern: 9 of 13 controls
- SP-030 API Security: 8 of 13 controls
- SP-046 External Attack Surface Management: 8 of 13 controls
- SP-001 Client Module: 7 of 13 controls
- SP-002 Server Module: 7 of 13 controls
- SP-011 Cloud Computing Pattern: 7 of 13 controls
- SP-015 Secure Remote Working: 7 of 13 controls
- SP-023 Industrial Control Systems: 7 of 13 controls

## Sub-techniques (4)
- T1566.001 Spearphishing Attachment: 12 controls
- T1566.002 Spearphishing Link: 11 controls
- T1566.003 Spearphishing via Service: 10 controls
- T1566.004 Spearphishing Voice: 0 controls

## MITRE mitigations (6)
- M1017 User Training
- M1021 Restrict Web-Based Content
- M1031 Network Intrusion Prevention
- M1047 Audit
- M1049 Antivirus/Antimalware
- M1054 Software Configuration

## MITRE detection strategies (1)
- DET0070 Detection Strategy for Phishing across platforms.

## Groups MITRE records using it (8)
G0001 Axiom; G0069 MuddyWater; G0094 Kimsuky; G0115 GOLD SOUTHFIELD; G1032 INC Ransom; G1041 Sea Turtle; G1049 AppleJeus; G1055 VOID MANTICORE.

## More
- This technique as JSON: /api/v1/attack/techniques/T1566
- On MITRE's site: https://attack.mitre.org/techniques/T1566
- In the matrix for people: /attack/?q=T1566
- The whole matrix as a card: /attack.md

## Sources and licences
- MITRE ATT&CK Enterprise v20.0 (2026-10-13), from MITRE's STIX data. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Terms: https://attack.mitre.org/resources/legal-and-branding/terms-of-use/
- CTID's mapping of NIST SP 800-53 Rev 5 to ATT&CK 16.1 (updated 04/16/2025), carried to v20.0 through MITRE's records of which techniques replaced which. CTID Mappings Explorer: © 2024 MITRE, Apache License 2.0.
- The data, with the method and the changes made: https://github.com/opensecurityarchitecture/osa-data/tree/main/data/mitre-attack
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.