Spearphishing Attachment
Technique · ATTACK:ics:T0865
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:ics:T0865",
"title": "Spearphishing Attachment",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T0865",
"snapshot": "ics-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--648f995e-9c3a-41e4-aeee-98bb41037426",
"external_id": "T0865",
"domain": "ics",
"created": "2020-05-21T17:43:26.506Z",
"modified": "2026-10-13T17:48:48.102Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"initial-access"
],
"source_references": [
{
"source_name": "CISA AA21-201A Pipeline Intrusion July 2021",
"url": "https://us-cert.cisa.gov/sites/default/files/publications/AA21-201A_Chinese_Gas_Pipeline_Intrusion_Campaign_2011_to_2013%20(1).pdf"
},
{
"source_name": "Enterprise ATT&CK October 2019",
"url": "https://attack.mitre.org/techniques/T1193/"
}
]
}Explicit source assertions (10)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:ics:G0064 → uses → ATTACK:ics:T0865
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f18b876-b698-4f70-aa98-50e8b5a7eae2
Andy Greenburg June 2019 · Jacqueline O'Leary et al. September 2017ATTACK:ics:G0032 → uses → ATTACK:ics:T0865
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31bf1721-78a2-4b6c-b325-5c44dc02ea33
Eduard Kovacs March 2018 · Novetta Threat Research Group February 2016ATTACK:ics:G0049 → uses → ATTACK:ics:T0865
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3618a010-b94b-4974-b1be-7630d5c853c1
Robert Falcone, Bryan Lee May 2016ATTACK:ics:G1000 → uses → ATTACK:ics:T0865
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--679e7b8d-57d7-4c1d-8f42-1496606ea666
Jeff Jones May 2018ATTACK:ics:M0917 → mitigates → ATTACK:ics:T0865
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--81ca994a-b350-424d-8f39-a0b64aa76260
ATTACK:ics:M0931 → mitigates → ATTACK:ics:T0865
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9a607f89-85b8-4fba-8eb7-7e4900ea693f
ATTACK:ics:M0949 → mitigates → ATTACK:ics:T0865
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bda03e8d-5e06-4470-b786-11b11c7c97c7
ATTACK:ics:M0921 → mitigates → ATTACK:ics:T0865
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c195a0e9-d46c-487f-9a96-b138e9ca05d2
ATTACK:ics:S0089 → uses → ATTACK:ics:T0865
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9165ecb-bc10-4189-a7e4-057bdf05bf3f
Booz Allen HamiltonATTACK:ics:S0093 → uses → ATTACK:ics:T0865
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e0aee02c-b424-4781-be10-793d71594c31
Daavid Hentunen, Antti Tikkanen June 2014