信息钓鱼

Sub-techniques (4)

ID	Name
T1598.001	端到端加密钓鱼通道
T1598.002	动态域名生成算法钓鱼
T1598.003	上下文感知钓鱼内容生成
T1598.004	隐蔽式数据回传机制

信息钓鱼是攻击者通过伪造可信实体诱导目标主动提供敏感信息的社交工程攻击技术，其传统形式包括伪造登录页面、钓鱼邮件等，依赖内容仿冒与身份伪装实现攻击目的。防御方通常采用邮件头分析、URL信誉检测、附件沙箱检测等手段进行防护，重点识别发件人伪造、恶意链接等显性特征。

为应对日益增强的检测能力，攻击者发展出融合加密通信、动态基础设施、AI内容生成的新型匿迹技术，通过技术对抗维度升级实现"隐形钓鱼"。这些技术突破传统社会工程学边界，将攻击链深度嵌入数字化业务流程，形成难以溯源的隐蔽攻击体系。

当前信息钓鱼匿迹技术的演进呈现"环境融合化"与"对抗智能化"双重特征。攻击者通过协议加密、云服务滥用实现通信层隐匿，利用算法生成技术实现资源层动态变化，结合上下文感知提升内容欺骗性：端到端加密通道技术将钓鱼交互包装为合规加密会话，规避内容检测；动态域名生成机制通过高频切换攻击基础设施破坏威胁情报时效性；上下文感知内容生成使钓鱼攻击具备精准社会工程特性；隐蔽式数据回传则利用云服务白名单策略绕过出口监控。四类技术的共性在于突破单点对抗模式，构建覆盖通信、资源、内容、数据全链路的匿迹体系，使得传统基于特征匹配的防御机制在多维动态攻击面前全面失效。

匿迹技术的发展迫使防御体系向行为分析、上下文关联检测方向演进，需构建覆盖加密流量解析、API操作审计、生成内容识别的多层防护能力，并强化云服务访问策略管控与员工数字足迹保护，形成对抗新型钓鱼攻击的纵深防御体系。

ID: T1598

Sub-techniques: T1598.001, T1598.002, T1598.003, T1598.004

ⓘ

Tactic: 目标侦查

ⓘ

Platforms: PRE

Contributors: Liora Itkin; Liran Ravich, CardinalOps; Ohad Zaidenberg, @ohad_mz; Philip Winther; Robert Simmons, @MalwareUtkonos; Scott Cook, Capital One; Sebastian Salla, McAfee

Version: 1.3

Created: 02 October 2020

Last Modified: 31 May 2024

匿迹效应

效应类型	是否存在
特征伪装	✅
行为透明	❌
数据遮蔽	✅
时空释痕	✅

特征伪装

攻击者通过高仿真钓鱼页面设计、合法云服务接口滥用及上下文关联内容生成，将恶意数据收集行为伪装成正常业务交互。HTTPS证书滥用使钓鱼站点具备可信标识，AI生成的个性化内容在语义层面与合法通信高度一致，云服务API调用则模仿企业正常办公流程，实现攻击链的深度合法化伪装。

数据遮蔽

端到端加密通道与云服务中转机制的结合，使钓鱼数据的传输全程处于加密状态。TLS协议保护通信内容，而云存储API加密传输则隐藏数据回传路径，防御方无法通过流量解密直接获取攻击证据，必须依赖行为链分析才能发现异常。

时空释痕

动态域名生成算法与分布式数据回传节点的配合，使得单个钓鱼攻击的特征被分散在数百个短生命周期域名和多个云服务账号中。攻击基础设施的快速更迭与全球分布特性，导致传统基于IP/域名聚合的检测方法难以有效关联攻击事件，显著延长威胁发现的平均时间。

Procedure Examples

ID	Name	Description
G0007	APT28	APT28 has used spearphishing to compromise credentials.^[1]^[2]
G0094	Kimsuky	Kimsuky has used tailored spearphishing emails to gather victim information including contat lists to identify additional targets.^[3]
G1036	Moonstone Sleet	Moonstone Sleet has interacted with victims to gather information via email.^[4]
G1015	Scattered Spider	Scattered Spider has used a combination of credential phishing and social engineering to capture one-time-password (OTP) codes.^[5]
G0128	ZIRCONIUM	ZIRCONIUM targeted presidential campaign staffers with credential phishing e-mails.^[6]

Mitigations

ID	Mitigation	Description
M1054	Software Configuration	Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.^[7]^[8]
M1017	User Training	Users can be trained to identify social engineering techniques and spearphishing attempts.

Detection

ID	Data Source	Data Component	Detects
DS0015	Application Log	Application Log Content	Depending on the specific method of phishing, the detections can vary. Monitor for suspicious email activity, such as numerous accounts receiving messages from a single unusual/unknown sender. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.^[7]^[8]When it comes to following links, monitor for references to uncategorized or known-bad sites. URL inspection within email (including expanding shortened links) can also help detect links leading to known malicious sites.Monitor social media traffic for suspicious activity, including messages requesting information as well as abnormal file or data transfers (especially those involving unknown, or otherwise suspicious accounts). Monitor call logs from corporate devices to identify patterns of potential voice phishing, such as calls to/from known malicious phone numbers.
DS0029	Network Traffic	Network Traffic Content	Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).
		Network Traffic Flow	Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

Data Source

Data Component

Detects

DS0015

Application Log

Application Log Content

Depending on the specific method of phishing, the detections can vary. Monitor for suspicious email activity, such as numerous accounts receiving messages from a single unusual/unknown sender. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.^[7]^[8]When it comes to following links, monitor for references to uncategorized or known-bad sites. URL inspection within email (including expanding shortened links) can also help detect links leading to known malicious sites.Monitor social media traffic for suspicious activity, including messages requesting information as well as abnormal file or data transfers (especially those involving unknown, or otherwise suspicious accounts).

Monitor call logs from corporate devices to identify patterns of potential voice phishing, such as calls to/from known malicious phone numbers.

DS0029

Network Traffic

Network Traffic Content

Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).

Network Traffic Flow

Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.