Getting started

How to use the framework

PH!SH describes a phishing message in three layers: the techniques it uses, the story it tells, and the action it asks for. This page shows how to classify a message and how to read the mappings.

Classify a message in three layers

Techniques Start with the mechanics. Record every one the message evidences: the delivery channel, the payload, the evasion, the harvester. Techniques stack.

Themes Record the story the message tells and the identity it claims. A message can carry more than one theme when each holds on its own, such as an executive impersonation that asks for gift cards.

Calls to action Record what the message itself asks the recipient to do, such as clicking a link, replying, or calling a number, rather than what happens later in the attack. If it asks for nothing, use None.

Multiple findings

Any layer can hold more than one entry, calls to action included. Record the smallest set of findings that together describe the attack: findings combine rather than offer alternatives, so several entries mean that each of them is true of the message, not that you are unsure which one applies. If two entries are possible and the message supports neither on its own, record neither: use the parent they share if the message supports it, or Other.

Do not tag a message with everything that might apply. An entry earns its place through what the message shows, not because it could fit.

None and Other are different answers. None means the message asks for nothing. Other means the message does something no entry describes, or there is not enough to tell.

Worked example: a stolen session

A message says a multi-factor request needs approval, and links to a page that proxies the real login and captures the session cookie. Classified in PH!SH:

TH0035 MFA Request: the story the message tells.

TE0006 Malicious Link: how the victim reaches the page.

TE0013 Adversary-in-the-Middle Authentication Proxy: how the credentials and session are taken.

CTA0001 Click Link: the action the message asks for.

Worked example: two themes in one message

A message signed with the chief executive’s name asks the recipient to buy gift cards and reply with the codes. Both stories hold, so both themes are recorded:

TH0011.1 Company Executive Impersonation: the identity the message claims.

TH0052 Gift Card Purchase or Code Request: what the money is for.

CTA0004 Reply: the action the message asks for.

When to use a sub-entry

Use the most specific entry the message supports. Choose the sub-entry when you can evidence its detail, such as an archive attachment rather than a malicious attachment in general, or an IT department impersonation rather than an internal sender in general. Use the parent when the message supports it but none of its sub-entries.

Sub-entries inherit their parent’s mappings and connections unless they carry their own. Where that happens, the entry says so.

Reading the mappings

Every entry page carries a “Mapped to” panel whose badges link to MITRE ATT&CK®. Use them to hand an incident to a team that works in ATT&CK, or to fold phishing volume into an existing ATT&CK-based report.

The ATT&CK view turns the same crosswalk around. It lays every referenced ATT&CK technique under its ATT&CK tactic and shows how many PH!SH entries sit behind each cell. From there you can export a Navigator layer and open it in ATT&CK Navigator alongside your other layers.

Unfamiliar terms

Entry pages list the other names a pattern goes by, and search finds an entry by any of them, so a familiar term such as ClickFix or quishing leads to the right entry.

Many of the terms used in the entries, such as smishing, homoglyph, or open redirect, are explained in the Hoxhunt cybersecurity glossary: hoxhunt.com/blog/cybersecurity-glossary-phishing

What this framework does not cover

PH!SH stops where the phishing stops. Post-compromise activity, malware families, and infrastructure attribution belong to ATT&CK. What a person with legitimate access does afterwards is insider risk, which PH!SH does not model.