Applied Cybernetics Group
T1204 — User Execution
- Technique
T1204- Tactics
- Execution
- MISP citations
- 0
- KEV CVEs mapped
- 2
- Community rules
- 10
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1204
MITRE description
An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of [Phishing](https://attack.mitre.org/techniques/T1566). While [User Execution](https://attack.mitre.org/techniques/T1204) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534). Adversaries may also deceive users into performing actions such as: * Enabling [Remote Access Tools](https://attack.mitre.org/techniques/T1219), allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539)s(Citation: Talos Roblox Scam 2023)(Citation: Krebs Discord Bookmarks 2023) * Downloading and executing malware for [User Execution](https://attack.mitre.org/techniques/T1204) * Coerceing users to copy, paste, and execute malicious code manually(Citation: Reliaquest-execution)(Citation: proofpoint-selfpwn) For example, tech support scams can be facilitated through [Phishing](https://attack.mitre.org/techniques/T1566), vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or [Remote Access Tools](https://attack.mitre.org/techniques/T1219).(Citation: Telephone Attack Delivery)
KEV CVEs mapped to this technique
Per MITRE CTID's hand-curated KEV→ATT&CK mappings — these are the actively-exploited vulnerabilities behind this technique's KEV signal.
Detection coverage
SigmaHQ community rules
- Potential Snatch Ransomware Activity (emerging-threats)
- PrinterNightmare Mimikatz Driver Name (emerging-threats)
- DarkSide Ransomware Pattern (emerging-threats)
- Antivirus Hacktool Detection (core)
- Payload Decoded and Decrypted via Built-in Utilities (core)
- Suspicious Execution via macOS Script Editor (core)
- Suspicious Deno File Written from Remote Source (core)
- Suspicious Binaries and Scripts in Public Folder (core)
- Arbitrary Shell Command Execution Via Settingcontent-Ms (core)
- Potentially Suspicious WebDAV LNK Execution (core)