{'created': '2018-04-18T17:59:24.739Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'Spearphishing via service is a specific variant of '
                'spearphishing. It is different from other forms of '
                'spearphishing in that it employs the use of third party '
                'services rather than directly via enterprise email '
                'channels. \n'
                '\n'
                'All forms of spearphishing are electronically delivered '
                'social engineering targeted at a specific individual, '
                'company, or industry. In this scenario, adversaries send '
                'messages through various social media services, personal '
                'webmail, and other non-enterprise controlled services. These '
                'services are more likely to have a less-strict security '
                'policy than an enterprise. As with most kinds of '
                'spearphishing, the goal is to generate rapport with the '
                "target or get the target's interest in some way. Adversaries "
                'will create fake social media accounts and message employees '
                'for potential job opportunities. Doing so allows a plausible '
                'reason for asking about services, policies, and software '
                "that's running in an environment. The adversary can then send "
                'malicious links or attachments through these services.\n'
                '\n'
                'A common example is to build rapport with a target via social '
                'media, then send content to a personal webmail service that '
                'the target uses on their work computer. This allows an '
                'adversary to bypass some email restrictions on the work '
                'account, and the target is more likely to open the file since '
                "it's something they were expecting. If the payload doesn't "
                'work as expected, the adversary can continue normal '
                'communications and troubleshoot with the target on how to get '
                'it working.',
 'external_references': [{'external_id': 'T1194',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1194'},
                         {'external_id': 'CAPEC-163',
                          'source_name': 'capec',
                          'url': 'https://capec.mitre.org/data/definitions/163.html'}],
 'id': 'attack-pattern--d3df754e-997b-4cf9-97d4-70feb3120847',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'initial-access'}],
 'modified': '2025-10-24T17:49:26.715Z',
 'name': 'Spearphishing via Service',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': True,
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': False,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['Windows', 'macOS', 'Linux'],
 'x_mitre_version': '1.1'}