ATT&CK technique · T1566.002
Phishing: Spearphishing Link
Initial Access· seen in 5 CISA KEV exploits
Full description, procedures and detections on attack.mitre.org
Who uses it
ATT&CK groups and malware with this technique. Highlighted: in SecurityTabs news this month.
Weaknesses that lead here
Classes of exploited vulnerability that CTID maps to this technique.
- CWE-792 KEV CVEsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Input is echoed into a web page as script, running in other users' browsers with their session.
- CWE-4161 KEV CVEUse After FreeThe program keeps using memory after releasing it, so an attacker who controls what lands there next can hijack execution.
- CWE-6931 KEV CVEProtection Mechanism FailureA security feature exists but can be bypassed or doesn't engage when it should.
- CWE-9181 KEV CVEServer-Side Request Forgery (SSRF)The server can be made to fetch a URL of the attacker's choosing, often internal services or cloud metadata.
Controls that mitigate it (11)
NIST SP 800-53 rev5, grouped by family (CTID mapping).
AC · Access Control
CA · Security Assessment and Authorization
CM · Configuration Management
IA · Identification and Authentication
SC · System and Communications Protection
SI · System and Information Integrity
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.