For a while now, we’ve wanted to start a mini-series on the interesting topics our Security Operations Center (SOC) encounters day to day. This is the first in what we hope will become a series exploring real-world lessons from the front lines of incident response, built on notes from our team discussions, reverse engineering sessions, and active incident responses.
During a recent SOC retrospective, our analysts discussed a common scenario: an attacker sent a phishing email with a link to a fake login page designed to harvest a user’s credentials. At first glance, it looked like a typical spearphishing attempt. But something didn’t quite add up when the team tried mapping it to MITRE ATT&CK.
The question: if the attacker’s goal is to steal credentials, does this still fall under Phishing (T1566) for initial access (TA0001)? Or should it be categorised differently? Spoiler: it’s not initial access, and the distinction matters.
Why this SOC case did not fit standard phishing
Broadly speaking, MITRE ATT&CK tactics represent why an attacker is doing something, while techniques represent how. This distinction matters because it shows the goal of a threat actor and the actions needed to achieve it. Applied to our case: there is no doubt the phishing email is the how. But what is the attacker’s actual end goal?
Is this really about gaining initial access to the victim’s network? Not quite. The email carried no malicious attachment, and the phishing link did not lead to a page trying to infect the user with malware. The attacker’s goal was not to get an immediate foothold in the network, but to collect information usable later in the kill chain. As a result, Initial Access does not correctly reflect this threat actor’s intent.
Finding the correct MITRE ATT&CK tactic
Tricking a user into handing over credentials more closely resembles an attacker gathering information to plan future operations. That is exactly how MITRE ATT&CK defines Reconnaissance (TA0043). Skimming through the possible tactics, one technique fits: T1598 — Phishing for Information.
MITRE itself makes the distinction we are drawing here. If the goal is not to execute attacker-controlled malicious code, the activity is not Phishing (T1566). Phishing for Information should be used instead to label the incident, since the objective is gathering data from the victim rather than executing malicious code.
Why the extra step is worth it
During the discussion, one analyst raised a fair point: why bother skimming through 400-plus ATT&CK mappings when the team could simply take action? It’s a valid question, and it touches on the very reason ATT&CK was created.
Mapped correctly, this case looks as follows:
- Step 1 — Reconnaissance: T1598.003 Spearphishing link. The attacker sends a phishing email to gather credentials.
- Step 2 — Credential Access: T1056.003 Web Portal Capture. A fake login page captures the user’s credentials.
- Step 3 — Initial Access: T1078 Valid Accounts. The attacker logs into the real service using the stolen credentials.
This sequence shows the attacker’s intent across the stages of a breach, using a shared taxonomy. A common language leads to better reporting and communication, between internal teams and across cyber threat intelligence (CTI) sharing. For example, if a threat group is known to run recon-phishing into valid-account abuse, precise mapping lets analysts attribute observed behaviour to known groups, and stay more precise than simply labelling the case “phishing”.
Tracked over time, ATT&CK mappings are also a good way to measure SOC maturity. With a precise mapping in place, a security team can finally answer: are we only catching emails with malicious attachments, or can we also catch credential harvesting?
What this means for your security awareness programme
This case is a reminder that security awareness cannot rely on a single mental model of “phishing”. Employees are trained to spot suspicious attachments and links, but credential-harvesting pages are built to look legitimate, and no malware ever touches the endpoint. A mature security awareness programme, paired with regular phishing simulation exercises, keeps employees alert to fake login pages specifically, while the SOC’s detection logic should independently flag valid-account logins from unusual locations or patterns, since that is where this kind of attack ultimately surfaces (T1078 Valid Accounts). Multi-factor authentication remains one of the most effective controls against that last step, even when credentials have already been stolen.
Conclusion: precision is what makes a SOC mature
In a SOC, precision matters. It is not just about what an attacker did, but why. That distinction guides further investigation and incident response, and clarifies later reporting. Not all phishing emails are the same, and your ATT&CK mapping should reflect that.
FAQ
What is the difference between Phishing (T1566) and Phishing for Information (T1598)?
Phishing (T1566) covers attempts to gain initial access, typically through malicious attachments or links that deliver malware. Phishing for Information (T1598) covers attempts to trick a target into handing over data, most often credentials, without executing any malicious code.
Why does this distinction matter for SOC maturity?
Correctly separating the two shows whether a SOC’s detection logic catches only malware-based phishing, or also credential-harvesting attempts that lead to valid-account abuse further down the kill chain.
Can a security awareness programme prevent credential-harvesting phishing?
Security awareness training reduces the number of employees who fall for fake login pages, but it does not replace SOC-side detection of stolen-credential misuse. The two need to work together as part of a wider security awareness and phishing simulation programme.
Curious how precisely your own SOC’s detection maps to MITRE ATT&CK?
» Talk to our SOC experts to review your current phishing detection coverage.