Getting started

How to use the framework

PH!SH describes a phishing message with three picks: the techniques it uses, the theme it borrows, and the action it asks for. This page shows how to make them and how to read the mappings.

Classify an attack in three picks

One or more techniques Start with the mechanics. Add every one you can evidence: the delivery channel, the payload, the evasion, the harvester. Techniques stack.

One theme Pick the single closest narrative. If two fit equally, pick the brand or authority being impersonated over the emotion being used.

One call to action Record what the message asks the recipient to do, such as clicking a link, replying, or paying an invoice. If it asks for nothing yet, use None.

Worked example

A message says a multi-factor request needs approval, and links to a page that proxies the real login and captures the session cookie. Classified in PH!SH:

TH0035 MFA: the story the message tells.

TE0006 Malicious Link: how the victim reaches the page.

TE0013 AitM Capable Credential Harvester: how the credentials and session are taken.

CTA0001 Click Link: the action the message asks for.

When to use a sub-entry

Use the parent when you know the mechanic but not the variant. Use the sub-entry when you can evidence the specific detail: a compressed archive rather than an attachment in general, an IT impersonation rather than internal authority in general.

Sub-entries inherit their parent’s mappings and connections unless they carry their own. Where that happens, the entry says so.

Reading the mappings

Every entry page carries a “Mapped to” panel whose badges link to MITRE ATT&CK®. Use them to hand an incident to a team that works in ATT&CK, or to fold phishing volume into an existing ATT&CK-based report.

The ATT&CK view turns the same crosswalk around. It lays every referenced ATT&CK technique under its ATT&CK tactic and shows how many PH!SH entries sit behind each cell. From there you can export a Navigator layer and open it in ATT&CK Navigator alongside your other layers.

Unfamiliar terms

Many of the terms used in the entries, such as smishing, homoglyph, or open redirect, are explained in the Hoxhunt cybersecurity glossary: hoxhunt.com/blog/cybersecurity-glossary-phishing

What this framework does not cover

PH!SH stops where the phishing stops. Post-compromise activity, malware families, and infrastructure attribution belong to ATT&CK. What a person with legitimate access does afterwards is insider risk, which PH!SH does not model.