<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-spear-phishing-campaigns
description: >-
  Detect and analyze targeted spear-phishing campaigns using behavioral
  analysis, sender profiling, content anomaly detection, and threat
  intelligence correlation to identify high-value targeted attacks.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - spear-phishing
  - targeted-attacks
  - behavioral-analysis
  - sender-profiling
  - bec
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566.001"]
---

# Detecting Spear-Phishing Campaigns

## Overview

Spear phishing targets specific individuals with personalized content,
bypassing commodity filters. This skill covers building detection rules for
targeted attacks including business email compromise (BEC), CEO fraud, vendor
impersonation, and thread hijacking. Detection relies on behavioral baselines,
sender anomaly scoring, and content analysis rather than signature matching.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling runtime |
| `pandas` | `pip install pandas` — data analysis |
| `scikit-learn` | `pip install scikit-learn` — anomaly detection |
| SIEM access | Splunk / Elastic / Sentinel query access |
| Mail flow logs | Exchange Message Trace or Google Workspace audit |

## Key Concepts

### Spear Phishing Indicators

| Indicator | Weight | Description |
|---|---|---|
| First-time sender | High | No prior correspondence with target |
| Display name impersonation | Critical | From name matches internal exec |
| Reply-to mismatch | High | Reply-to domain differs from envelope |
| Urgency + authority | Medium | Executive pressure language patterns |
| Financial request | Critical | Wire transfer, gift card, invoice redirect |
| Attachment + external sender | Medium | Macro-enabled docs from unknown sender |
| Thread hijack | Critical | RE:/FW: with injected content in real thread |

### Detection Layers

```
Layer 1 — Gateway Rules     : SPF/DKIM/DMARC enforcement, impersonation protection
Layer 2 — Content Analysis  : NLP-based urgency scoring, financial keyword detection
Layer 3 — Behavioral        : Sender frequency baseline, communication graph anomaly
Layer 4 — User Reporting    : Phish alert button triage and correlation
Layer 5 — Threat Intel      : IOC matching, campaign clustering, infrastructure pivot
```

### MITRE ATT&CK Mapping

| Technique | ID | Description |
|---|---|---|
| Phishing: Spearphishing Attachment | T1566.001 | Targeted email with malicious attachment |
| Phishing: Spearphishing Link | T1566.002 | Targeted email with malicious link |
| Phishing: Spearphishing via Service | T1566.003 | Targeted via third-party service |

## Workflow

### 1. Build Sender Baselines

```bash
# Export mail flow data for baseline analysis
node agent.js build-baseline --mail-log /var/log/mail/flow.csv \
  --days 90 --output /tmp/sender_baseline.json

# Query M365 message trace for sender patterns
# Search-AdminAuditLog | Export-Csv /tmp/mail_trace.csv
```

### 2. Detect Anomalies

```bash
# Score incoming messages against baseline
node agent.js score-message --headers /tmp/suspect_msg.txt \
  --baseline /tmp/sender_baseline.json

# Detect display name impersonation
node agent.js detect-impersonation --message /tmp/suspect_msg.txt \
  --executive-list /tmp/vip_names.txt

# Scan for financial request patterns
node agent.js detect-bec --message /tmp/suspect_msg.txt
```

### 3. Campaign Correlation

```bash
# Cluster related spear-phishing attempts
node agent.js cluster-campaign --ioc-file /tmp/iocs.json \
  --window 7d

# Generate Sigma detection rule
node agent.js generate-sigma --detection-type impersonation
```

### 4. SIEM Queries

```bash
# Splunk — first-time sender to executive
# index=email recipient_role=executive
# | stats earliest(_time) as first_seen by sender_domain
# | where first_seen > relative_time(now(), "-24h")

# KQL — display name impersonation
# EmailEvents
# | where SenderDisplayName in ("CEO Name", "CFO Name")
# | where SenderFromDomain != "company.com"
```

## Detection

```yaml
title: Spear Phishing Campaigns Detection
id: 3c4217b7-2c82-44d8-bb6e-96b76d4c762a
status: experimental
description: Detects suspicious activity related to detecting spear phishing campaigns techniques in phishing defense context
logsource:
  category: email
  service: o365
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: high
tags:
  - attack.t1566.001
  - attack.initial_access
falsepositives:
  - Security awareness training platform sending simulated phishing emails
```

## Verification

| Check | Method |
|---|---|
| Baseline built | JSON contains sender frequency data |
| Anomaly score calculated | Score output between 0.0-1.0 |
| Impersonation detected | VIP name match with external sender |
| BEC patterns flagged | Financial keywords with urgency score |
| Campaign clustered | Related IOCs grouped by infrastructure |
| Sigma rule valid | `sigma check` passes |

## References

- [MITRE ATT&CK T1566 — Phishing](https://attack.mitre.org/techniques/T1566/)
- [FBI IC3 BEC Report](https://www.ic3.gov/Media/Y2023/PSA230609)
- [Microsoft Anti-Phishing Policies](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about)
- [Proofpoint Spear Phishing Research](https://www.proofpoint.com/us/threat-reference/spear-phishing)
