T1204.002 — Malicious File

Technique

T1204.002

Tactics

Execution

MISP citations

0

KEV CVEs mapped

33

Community rules

36

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1204/002

MITRE description

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001). Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.(Citation: Mandiant Trojanized Windows 10) Adversaries may employ various forms of [Masquerading](https://attack.mitre.org/techniques/T1036) and [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.(Citation: Password Protected Word Docs) While [Malicious File](https://attack.mitre.org/techniques/T1204/002) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534).

KEV CVEs mapped to this technique

Per MITRE CTID's hand-curated KEV→ATT&CK mappings — these are the actively-exploited vulnerabilities behind this technique's KEV signal.

• CVE-2025-27363
• CVE-2024-38080
• CVE-2023-36884
• CVE-2023-26369
• CVE-2023-21715
• CVE-2023-21608
• CVE-2022-34713
• CVE-2022-30190
• CVE-2021-28550
• CVE-2021-21017
• CVE-2018-4990
• CVE-2018-4878
• CVE-2018-15982
• CVE-2017-11292
• CVE-2016-4117
• CVE-2016-0984
• CVE-2015-7645
• CVE-2015-3113
• CVE-2015-3043
• CVE-2014-0496
• CVE-2013-0641
• CVE-2012-1535
• CVE-2012-0754
• CVE-2011-2462
• CVE-2011-0611
• CVE-2010-2883
• CVE-2010-1297
• CVE-2009-4324
• CVE-2009-3953
• CVE-2009-1862
• CVE-2008-2992
• CVE-2008-0655
• CVE-2007-5659

Detection coverage

SigmaHQ community rules

• Exploit for CVE-2017-0261 (emerging-threats)
• Droppers Exploiting CVE-2017-11882 (emerging-threats)
• Exploit for CVE-2017-8759 (emerging-threats)
• Ursnif Malware C2 URL Pattern (emerging-threats)
• Potential Maze Ransomware Activity (emerging-threats)
• Kapeka Backdoor Loaded Via Rundll32.EXE (emerging-threats)
• Successful MSIX/AppX Package Installation (threat-hunting)
• Microsoft Excel Add-In Loaded (threat-hunting)
• Microsoft Word Add-In Loaded (threat-hunting)
• Suspicious Microsoft Office Child Process - MacOS (core)
• Download From Suspicious TLD - Blacklist (core)
• Download From Suspicious TLD - Whitelist (core)
• Flash Player Update from Suspicious Location (core)
• AppLocker Prevented Application or Script from Running (core)
• Windows AppX Deployment Full Trust Package Installation (core)
• Windows AppX Deployment Unsigned Package Installation (core)
• File With Uncommon Extension Created By An Office Application (core)
• Suspicious Startup Folder Persistence (core)
• DotNET Assembly DLL Loaded Via Office Application (core)
• CLR DLL Loaded Via Office Applications (core)
• GAC DLL Loaded Via Office Applications (core)
• Microsoft Excel Add-In Loaded From Uncommon Location (core)
• Microsoft VBA For Outlook Addin Loaded Via Outlook (core)
• VBA DLL Loaded Via Office Application (core)
• Remote DLL Load Via Rundll32.EXE (core)

Showing 25 of 36 community rules — the full set is tagged attack.t1204.002 in SigmaHQ.

Signal counts reflect the current corpus snapshot: MISP citations are regex-extracted from CIRCL OSINT event text and galaxy tags; KEV mappings come from MITRE CTID; community coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting collections) at release r2026-04-01. Rule bodies are not mirrored — links go upstream.