SecureAEye LAB ONLINE · SIG 657 · DET ~41s

← All attacks / Social engineering and human-targeted attacks

Malspam

Mass email with malicious attachments or links delivering commodity malware

categorySocial engineering and human-targeted attacksseverityHighdetectabilityHighlabnot yet measured

Example: Emotet-style

Classification

30 values: 15 imported, 1 derived, 14 machine-classified. What do these mean?

Exploitability

Attack vector	Social engineering
Reach (CVSS)	Social
Attack complexity	Low
Privileges required	None
User interaction	Active
Attacker skill required	Low
Resources required	Low
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Severity	High
Impact	ConfidentialityIntegrity
Platform	Identity ProviderLinuxmacOSOffice SuiteSaaSWindows
Environment	On-premises
Target asset class	EndpointHuman
Kill-chain phase (tactic)	Initial Access

Detection & telemetry

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Application Log ContentFile CreationNetwork Connection CreationNetwork Traffic ContentNetwork Traffic FlowProcess Creation

Detection & response

Mitigated by 41

Detected by 29

DET0107 attack-detection-strategy
DET0236 attack-detection-strategy
023394c4-29d5-46ab-92b8-6a534c6f447b sigma
0248a7bc-8a9a-4cd8-a57e-3ae8e073a073 sigma
0e29e3a7-1ad8-40aa-b691-9f82ecd33d66 sigma
1cdd9a09-06c9-4769-99ff-626e2b3991b8 sigma
24de4f3b-804c-4165-b442-5a06a2302c7e sigma
295a59c1-7b79-4b47-a930-df12c15fc9c2 sigma
2f9356ae-bf43-41b8-b858-4496d83b2acb sigma
3569aefd-e535-4391-8c18-24bd01a21eaf sigma
38e7f511-3f74-41d4-836e-f57dfa18eead sigma
4358e5a5-7542-4dcb-b9f3-87667371839b sigma
52cad028-0ff0-4854-8f67-d25dfcbc78b4 sigma
538c5851-8c03-4724-8ec4-623bc7aadaea sigma
571498c8-908e-40b4-910b-d2369159a3da sigma
678eb5f4-8597-4be6-8be7-905e4234b53a sigma
6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4 sigma
864403a1-36c9-40a2-a982-4c9a45f7d833 sigma
91174a41-dc8f-401b-be89-7bfc140612a0 sigma
932ac737-33ca-4afd-9869-0d48b391fcc9 sigma
a018fdc3-46a3-44e5-9afb-2cd4af1d4b39 sigma
b1c50487-1967-4315-a026-6491686d860e sigma
bf241472-f014-4f01-a869-96f99330ca8c sigma
c27515df-97a9-4162-8a60-dc0eeb51b775 sigma
dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c sigma
e0e121d0-be4d-4281-af7e-17abbba4a408 sigma
e8a95b5e-c891-46e2-b33a-93937d3abc31 sigma
fabb0e80-030c-4e3e-a104-d09676991ac3 sigma
fdd84c68-a1f6-47c9-9477-920584f94905 sigma

Tested by 3

114ccff9-ae6d-4547-9ead-4cd69f687306 atomic
bc177ef9-6a12-4ebc-a2ec-d41e19c2791d atomic
cbb6799a-425c-4f83-9194-5447a909d67f atomic

Attack relationships

Framework references

Primary source: https://www.crowdstrike.com/en-us/cybersecurity-101/malware/
attack: T1566.001 (primary)
attack: T1566.002

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Social engineering and human-targeted attacks' table, line 57 of Cyber-Attack-Taxonomy.md
ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1566.001, attack:T1566.002 as the nearest framework entries; ids verified to exist in the cached catalogues.
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 149 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 86 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)