ATT&CK T1534 Internal Spearphishing Guide

Once an attacker controls one mailbox or chat account, every colleague of that person becomes a target who has every reason to trust the next message. MITRE ATT&CK tracks this as T1534 Internal Spearphishing, a Lateral Movement technique on Linux, macOS, Office Suite, SaaS and Windows. Internal messages often take a different path from inbound mail, carry a sender everyone recognises and arrive in chat tools that users treat as safe. This guide covers how the technique works, which protections actually apply to internal traffic, the DET0054 detection analytics, and a containment sequence for when one account starts phishing the rest of the organisation. It is written for email and collaboration administrators, detection engineers and incident responders. For external phishing see MITRE ATT&CK T1566 Phishing; for email log sources see the Email Gateway and Message Trace Detection Guide.

Key takeaways

It starts after a compromise. ATT&CK describes T1534 as a multi-stage campaign: a legitimate account is taken over first, through its device or its credentials, and then used to phish others inside the same organisation.
Trust is the payload. The sender is real, the tone can be copied from sent items and replies land in existing threads, so user training built around spotting strangers does less here.
Internal paths need their own protection. Link and attachment scanning for internal mail and for chat is often a separate setting from inbound scanning. Confirm it is on.
Chat is in scope. ATT&CK names internal chat apps such as Microsoft Teams as a delivery channel for malicious content and credential capture.
Contain the sender, then the recipients. Response has two halves: stop the compromised account, and find, purge and check every message and click it produced.

How the technique works

ATT&CK v20 defines T1534 as adversaries using internal spearphishing, after they already have access to accounts or systems, to gain access to additional information or compromise other users in the same organisation. The technique has no sub-techniques. The delivery methods are those of external phishing, run from the inside:

Attachments and links: T1566.001 Spearphishing Attachment to deliver a payload, or T1566.002 Spearphishing Link to a credential capture page, recorded under T1056 Input Capture.
Impersonation: ATT&CK notes T1534 often incorporates T1684.001 Impersonation, using the trusted account's identity and context.
Chat: malicious files or links posted in internal channels or direct messages, or conversations designed to draw out credentials.

Who uses it

Group or campaign (ATT&CK v20)	Recorded behaviour
APT-C-36	Used a compromised account to email an address likely monitored by the IT team
Gamaredon Group	Outlook VBA module that sends malicious attachments to other employees
HEXANE	Internal spearphishing against executives, HR and IT staff
Kimsuky	Internal spearphishing for lateral movement after stealing victim information
Leviathan	Internal spearphishing for lateral movement
MuddyWater	Used compromised mailboxes inside target organisations to send spearphishing
NIMBUS MANTICORE	Internal spearphishing against IT staff and administrators
Operation Dream Job (Lazarus Group)	Internal spearphishing from within a compromised organisation

The Gamaredon case shows how automated this can be: ATT&CK records that the group used an Outlook VBA module on infected systems to send phishing emails with malicious attachments to other employees. The Gamaredon Group Threat Actor Profile covers the group itself. The pattern to note is that IT, HR and administrators are recurring targets: the attacker is moving towards accounts with more access.

Controls that apply to internal traffic

Many email protections were designed for mail arriving from the internet. The table lists controls that address the internal path, using Microsoft 365 setting names where the vendor documents them. Equivalent controls exist in other platforms under different names; confirm them in your provider's documentation.

Control	Setting or mechanism	What it stops
Link checking for internal mail	Safe Links policy: "Apply Safe Links to email messages sent within the organization" (recommended on)	Malicious links between internal senders and recipients, checked at click time
Link checking in chat	Safe Links policy, Teams section: checks known malicious links at click time in chats, channels and tabs (URLs are not rewritten)	Malicious links posted in Teams
Click evidence	"Track user clicks" on; "Let users click through to the original URL" off	Gives responders the list of who clicked; prevents click-through past a warning
Outbound abuse limits	Outbound spam protection and the default alert policies "User restricted from sending email", "Suspicious email sending patterns detected" and "Email sending limit exceeded"	Mass internal or external sending from a compromised account
User reporting in chat	Teams admin center messaging policy "Report a security concern"; Defender portal "Monitor reported items in Microsoft Teams"	Gets suspicious chat messages to the SOC; alerts fire by default on reports
Macro restrictions	Block macros in files from the internet; restrict macro security changes	Payload attachments of the Gamaredon kind; see the Office Macro Blocking Guide
Strong authentication on every mailbox	Phishing-resistant MFA and Conditional Access	The first-stage compromise that T1534 depends on

Two details are easy to miss. In Microsoft 365, the Built-in protection preset gives Safe Links coverage in email, Teams and Office files to licensed users who are not in a Standard, Strict or custom policy, and internal protection depends on the recipient's policy. And Safe Links changes for Teams can take up to 24 hours to apply, so do not test immediately after a change. The Microsoft Teams Security Guide covers external access and app controls that sit around this.

Detection: the DET0054 analytics

ATT&CK v20 detection strategy DET0054, Internal Spearphishing via Trusted Accounts, has five platform analytics. All share one shape: abnormal account activity, then internal messages, then clicks or execution at recipients.

Analytic	Platform	Sequence to detect	Log sources named by ATT&CK
AN0147	Windows	Internal mail from a recently compromised account (after abnormal logon or device activity) with attachments or links, followed by clicks, process starts or credential prompts	Security 4624, 4625, 4648, 4672; Sysmon 1; m365:unified SendOnBehalf, MessageSend, ClickThrough, MailItemsAccessed
AN0148	Linux	Unexpected user activity, internal mail transfer, then download or execution of attachments	auditd execve; mail server logs with internal sender and recipient; syslog for download tools
AN0149	macOS	Internal mail relays followed by file or script execution launched from the mail client	macOS unified log
AN0150	SaaS	Message from a compromised user with a file or URL in Slack, Teams or Gmail, followed by clicks and credential access	saas:slack file_upload, message_send, message_click
AN0151	Office Suite	Outlook or Word forwarding internal attachments with macro content, auto-open or macro prompts	m365:unified SendOnBehalf, MessageSend, AttachmentPreviewed; PowerShell 4103 to 4106

Rules worth building

Burst from one sender: one internal account sending to many internal recipients in a short window, with the same subject or attachment hash. Our starting threshold is 25 distinct internal recipients in an hour for a user who normally sends to fewer than five; tune it to your baseline.
Risky sign-in then send: a risky or first-seen-location sign-in followed within hours by internal mail containing links or attachments.
Sent items hidden: new inbox rules that move or delete replies from colleagues, which keep the account holder unaware. See MITRE ATT&CK T1564.008 Hide Artifacts.
Clicks on one sender's links: Safe Links click events (UrlClickEvents in advanced hunting) clustered on URLs from a single internal sender.
Chat to many: one account posting the same link or file to many direct chats it has not used before.
Targeting pattern: internal messages from a non-IT user to IT, HR or administrator mailboxes they have no history with.

Containment and response

Stop the sender: revoke the account's sessions, reset its credentials and block sign-in while you investigate. If the source is a compromised device, isolate it, as tooling on the endpoint may keep sending.
Find every message: use message trace and content search for all mail the account sent in the window, and the chat audit for messages it posted. Search by sender, subject, URL and attachment hash.
Purge and warn: remove the messages from recipient mailboxes and chats, then tell recipients directly through a channel that does not rely on the compromised account.
Check the clickers: for each recipient who clicked or opened, check for credential entry, new MFA methods, new sessions and process execution. Treat confirmed cases as new compromises; this is where the lateral movement either stopped or did not.
Look for persistence on the first account: forwarding and hiding rules, delegated access, OAuth grants and app passwords. See MITRE ATT&CK T1671 Cloud Application Integration and MITRE ATT&CK T1697 Steal Application Specific Passwords.
Go back to the first stage: find out how the original account was compromised; that is the root cause, not the internal phish.

The Business Email Compromise Response Playbook provides the roles, evidence and notification steps in template form.

Decision guidance

Purge automatically or after review? Automatic purge on a high-confidence burst limits clicks; manual review avoids deleting genuine all-staff mail. Many teams auto-purge only when a URL or file is already rated malicious.
Block the sender automatically? Outbound restriction on volume is already automatic in Microsoft 365. Adding automatic sign-in blocking on risky-sign-in-then-burst sequences is sensible for most users, with an exception path for executives' assistants and communications teams who send at volume.
Small organisations: turn on internal link checking and chat reporting, and use the default outbound alerts. That covers most of the risk.
Large organisations: build the DET0054 sequences in the SIEM, join email, chat and endpoint data, and rehearse the purge and warn steps.

Where identity fits

T1534 is T1078 Valid Accounts put to work. Shared mailboxes, service mailboxes used by applications and accounts with send-as or send-on-behalf rights deserve special attention: they send to many people, so a burst may look normal, and their credentials are often held by systems rather than people. Inventory which identities can send as whom, keep delegation narrow and monitor delegated sending (SendOnBehalf is one of the events DET0054 names).

Framework mapping

Framework	Reference	Relevance
MITRE ATT&CK v20	T1534 (TA0008 Lateral Movement); related T1566.001, T1566.002, T1056, T1684.001, T1078	Technique, delivery and follow-on
NIST SP 800-53 Rev. 5	SI-8 Spam Protection; SI-4 System Monitoring; AT-2(3) Literacy Training and Awareness: Social Engineering and Mining	Internal message scanning, sequence detection, awareness of trusted-sender lures
NIST SP 800-53 Rev. 5	IA-2(1) Multi-factor Authentication to Privileged Accounts; AC-6 Least Privilege	Preventing the first-stage account compromise; narrow send-as rights
NIST CSF 2.0	PR.AT-01 (awareness and training); DE.CM-03 (personnel activity monitored); RS.MI-01 (incidents contained)	Training, monitoring and containment outcomes

Measuring progress

Share of users covered by link checking for internal mail and for chat.
Time from the first internal phishing message to sender containment.
Time from containment to purge of all related messages.
Percentage of internal phishing messages reported by recipients, by channel.
Number of secondary compromises per incident, which shows whether containment is fast enough.

Common failure patterns

Inbound-only scanning: link and attachment checks applied to internet mail but not to internal mail or chat.
Closing on the sender: resetting the first account but never checking who clicked.
Warning through the compromised channel: an all-staff message that recipients cannot distinguish from the attacker's.
Ignoring the endpoint: resetting credentials while a mail client macro on the device keeps sending.
No chat reporting: users have nowhere to report a suspicious Teams or Slack message, so the SOC never hears of it.

Practitioner checklist

Confirm link checking covers internal mail and chat for every user.
Turn on click tracking and turn off click-through past warnings.
Route outbound restriction and suspicious sending alerts to the SOC, not only to global administrators.
Enable user reporting of chat messages and test that reports arrive.
Build the burst, risky-sign-in-then-send and hiding-rule detections.
Write a purge and warn procedure with an out-of-band warning channel.
Inventory send-as and send-on-behalf rights and remove the ones nobody needs.
Include an internal-sender scenario in phishing awareness exercises.

MITRE ATT&CK T1534 Internal Spearphishing: Detecting and Containing Lateral Movement