PH!SH Framework
Framework / Techniques
Technique Payload Delivery

Malicious Attachment

The message is built around a file attached to it, and opening that file is usually the step it leads to. A file can carry content, such as links or code, that only shows once it's opened.

Also known as
Aliases
  • malspam
  • Spearphishing Attachment
  • infected attachment
Mapped to
MITRE ATT&CK®
T1566.001Spearphishing Attachment

Sub-techniques

TE0005.1 Executable Attachment
The attached file is a program, such as an .exe file, which runs as soon as it's opened. Ordinary work rarely involves receiving programs by email, which makes one worth noticing.
TE0005.2 HTML Attachment
This attachment is a web page file, such as an .html or .htm file, that opens in your browser. It can display a whole web page, including a sign-in form, straight from the file.
TE0005.3 PDF Attachment
The attached file is a PDF document. PDFs feel familiar and can hold links, QR codes, or buttons that lead elsewhere, which is why attackers often use them.
TE0005.4 Disk Image Attachment
The attached file is a disk image, such as an ISO, IMG, or VHD file, which opens like a separate drive holding other files. Files packed this way can skip some warnings shown for downloads.
TE0005.5 Office Document Attachment
The attached file is a Word, Excel, PowerPoint, OneNote, or similar Office document. These everyday files can hold links, embedded files, or macros, which are small programs inside the document.
TE0005.6 Email Message Attachment
The attachment is itself an email, saved as an .eml or .msg file. Opening it shows a second email, whose links and files may not have been checked the same way as the outer one.
TE0005.7 Archive Attachment
The attached file is a compressed archive, such as a ZIP, RAR, or 7z file, that holds other files. Packing files this way hides what's inside until the archive is opened.
TE0005.8 Plain-Text Attachment
The attached file is plain text, such as a .txt or .log file. Text files can't run on their own, but they can carry links, instructions, or commands for the recipient to copy.
TE0005.9 Image Attachment
The attached file is an image, such as a JPG, PNG, GIF, or SVG file. Images can carry QR codes or text that filters may not read, and SVG files can also hold links and code.
TE0005.10 Calendar Attachment
The attached file is a calendar event, such as an .ics file, which opens as a meeting or reminder. Event details can carry links and keep the request in view after the message is gone.
TE0005.11 Installer Package Attachment
The attached file is a software installer package, such as an MSI or MSIX file. In most workplaces software comes from IT, so an installer arriving by email is unusual.
TE0005.12 Shortcut Attachment
The attached file is a shortcut, such as a .lnk or .url file, which opens a program, command, or web address when clicked. A shortcut can look like a document while pointing somewhere else.
TE0005.13 Script Attachment
The attached file is a script, such as a .js, .vbs, or .bat file, which is code Windows can run when it's opened. Scripts are rarely sent by email in ordinary work, so one arriving this way stands out.

Connected in PH!SH

Themes
TH0005Document Sharing Service Impersonation TH0015Billing Notice TH0016Procurement Request TH0038Security Update Notice TH0046Enterprise System Impersonation TH0049Vendor Payment Redirection Request TH0050Payroll Payment Redirection Request TH0052Gift Card Purchase or Code Request TH0053Refund or Rebate Offer TH0054Incoming Payment Notice TH0055Overpayment Return Request TH0066Payment Information Update TH0071Penalty Notice