MITRE ATT&CK in Practice: Mapping a Real Phishing Campaign
How to take a real-world phishing campaign and map every observed technique to the MITRE ATT&CK framework, turning raw IOCs into structured threat intelligence.
Introduction
Most security teams have heard of MITRE ATT&CK. Fewer actually use it operationally. After analysing a phishing campaign targeting financial sector employees, I mapped every observed behaviour to the framework and the result was a structured picture that made detection engineering significantly easier.
The Campaign
The campaign arrived as a DocuSign-themed email with a malicious HTML attachment. Opening the attachment triggered a credential harvesting page hosted on a compromised WordPress site. Victims who entered credentials were silently redirected to the legitimate DocuSign login to avoid suspicion.
ATT&CK Mapping
Initial Access — T1566.001 (Spearphishing Attachment) The initial vector was an HTML file attached directly to the email. This bypasses many URL-filtering controls since no external link appears in the email body.
Execution — T1204.002 (User Execution: Malicious File) The victim had to open the attachment, no exploit was required. Social engineering carried the entire execution phase.
Credential Access — T1056.003 (Web Portal Capture) The HTML page rendered a pixel-perfect DocuSign login form. Credentials were POSTed to an attacker-controlled endpoint.
Command and Control — T1102 (Web Service) The harvesting infrastructure used a legitimate compromised WordPress site, making domain reputation blocking ineffective.
Collection — T1213 (Data from Information Repositories) Once credentials were captured, the attacker accessed the victim's email and SharePoint to collect internal documents.
Detection Opportunities
Mapping to ATT&CK immediately surfaces detection gaps. In this case:
- No alerting on HTML attachments delivered via email
- No monitoring of POST requests to external domains from browser sessions
- No anomaly detection on SharePoint access from new geolocation
Each gap became a detection engineering ticket.
Conclusion
ATT&CK is most valuable not as a compliance checklist but as a shared language between threat intelligence, detection engineering, and incident response. Mapping campaigns as you analyse them builds institutional knowledge that compounds over time.