Security teams should place detections higher on the Pyramid of Pain, where they target generic attacker behavior instead of easy to change artifacts like URLs, IPs, or page titles. The strongest controls focus on actions that must happen for the attack to succeed, such as entering credentials into the wrong page. That approach makes detections harder to evade and more durable over time.
Why This Matters for Security Teams
Phishing detections fail when they are tied to what attackers can change cheaply, not to what their workflow requires. A URL rewrite, alternate sender domain, or copied page title is easy to rotate; the act of harvesting credentials, persuading a user to submit them, or moving to a second-stage login is harder to hide. Teams that anchor detections to durable behaviour reduce the attacker’s ability to iterate around one rule and keep the signal useful after small campaign changes.
This matters most in environments where phishing is a gateway to account takeover, MFA fatigue, token theft, or credential replay. Detection logic that only looks for known-brand lures, newly registered domains, or attachment names tends to age quickly because those artifacts are disposable. Behavioural detections are more resilient because they model the attacker’s objective and the victim interaction pattern, not the skin of the message. In practice, many security teams discover their “good” phishing rule set was really a list of yesterday’s indicators only after the campaign has already evolved.
How It Works in Practice
Effective phishing detection starts by defining the action sequence that must occur for compromise to succeed. That usually includes message delivery, user interaction, credential entry, token capture, consent abuse, or redirection into an impersonated login flow. The best detections then watch for combinations of signals that reflect those steps, rather than one brittle artifact.
Useful patterns include:
- logins immediately following suspicious message delivery or link clicks
- credential submission to domains or pages that mimic known services but are not the genuine authentication endpoint
- unusual first-time authentication from a message-driven referral path
- bursts of similar lures that share structure, timing, or user targeting even when the URLs differ
- post-click behaviour that indicates harvesting infrastructure, such as repeated form loads, redirects, or session capture attempts
Teams get better durability when detections combine email, identity, proxy, endpoint, and browser telemetry, because no single control sees the full chain. That lets analysts flag the campaign on the basis of outcome-driven behaviour, not on an individual lure that can be swapped out overnight. The same principle applies to allowlists and suppressions: if a detection is based on a static characteristic, assume it will be defeated by the next minor mutation.
MITRE D3FEND is useful here because it frames detections around defensive countermeasures that map to attacker technique, not just to isolated indicators. SANS security resources are also helpful when teams want to tune detection engineering practice around real SOC workflows rather than theoretical patterns. These controls tend to break down when telemetry is fragmented across email and identity systems, because the attack chain becomes visible only in hindsight.
Common Variations and Edge Cases
Tighter behavioural detection often increases tuning overhead, requiring organisations to balance resilience against false-positive handling and data availability. The right level of abstraction depends on whether the organisation is defending against broad commodity phishing or a targeted campaign with bespoke infrastructure.
For commodity phishing, generic behaviour such as suspicious credential submission or abnormal post-click authentication often gives the best return because it survives domain churn and lure rewrites. For targeted attacks, teams usually need more context around the victim group, impersonated service, and sequence of actions because the adversary will imitate normal business workflows more closely. There is no universal standard for this yet, but current guidance suggests prioritising the behavior that would remain visible even if every message artifact were replaced.
One common edge case is legitimate login flows that resemble phishing, especially in SSO-heavy environments or when users are redirected through multiple domains. Another is when attackers never host a full fake page and instead abuse consent screens, embedded forms, or token theft paths. In those cases, a detection tuned only to classic credential harvesting will miss the compromise path entirely.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1566 — Phishing | Phishing detections should key on ATT&CK phishing behaviors, not mutable lure artifacts. |
| Recommendation — Map detections to T1566 behavior and alert on user interaction and credential theft patterns. | ||
| CIS Controls v8 | 8.11 — Untrusted Content Detonation | Phishing detection improves when suspicious content is analyzed before user execution or click-through. |
| Recommendation — Use detonation and inspection controls to expose phishing behavior before it reaches users. | ||
Practitioner Guidance
What to prioritise: Build detections around the smallest set of attacker actions that must occur for compromise, then test whether the rule still fires after the lure domain, page title, and visual branding are changed. If the answer is no, the detection is too close to the surface.
What to verify: Validate that the signal can be supported by telemetry outside the email channel, especially identity logs and post-click activity. A phishing detector is stronger when it can prove that a user interaction led to a suspicious authentication or credential submission path, not merely that a suspicious message existed.
Practitioner takeaway: The most durable phishing detections are outcome-based, not artifact-based, because they force attackers to change the operation itself rather than only the packaging.
Related resources from NHI Mgmt Group
- How should security teams design caller verification so attackers cannot redirect it?
- How should security teams validate GCP audit-log detections before relying on them in production?
- How should security teams handle exposed cloud keys before attackers use them?
- How should security teams handle modern phishing when attackers spoof trusted roles?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 16, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
