Filter Evasion
Attackers employ obfuscation techniques to bypass email security filters, spam detection, and content inspection tools. These methods are designed to disguise payloads, URLs, or message content while preserving malicious intent.
Sub-techniques
TE0010.1
Obfuscation
Attackers manipulate the email subject or body using misspellings, special characters, or formatting tricks to evade content-based filters while maintaining human readability.
TE0010.2
Bayesian Poisoning
Messages are padded with benign or irrelevant text to manipulate spam filters and reduce detection likelihood based on statistical content models.
TE0010.3
Email Body Is An Image
The email's content is delivered as an image instead of text, preventing text-based scanners from analyzing or detecting phishing language.
TE0010.4
Links To Third-Party Service
Phishing content is hosted on trusted platforms (e.g., Google Docs, Dropbox) to bypass URL filtering and exploit domain reputation.
TE0010.5
Obscured URL
URLs are visually disguised using techniques like zero-width spaces, hex encoding, or homoglyphs, making malicious links appear legitimate.
TE0010.6
Encoded URL
URLs are base64 or URL-encoded to bypass detection mechanisms and delay analysis by email security tools.
TE0010.7
Reconnaissance Email
Adversaries send benign-looking emails to verify active addresses, identify targets, or gather behavioral signals before launching a phishing campaign.