T1204 User Execution

Technique

T1204

Tactics

Execution

Research, 90 days

4

KEV CVEs mapped

2

SigmaHQ rules

10

Elastic, Splunk

75

thrunt rules

0

Active families

ClickFix, delivery cluster (delivers →; downstream TTPs payload-dependent)

Upstream

https://attack.mitre.org/techniques/T1204

MITRE description

An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of [Phishing](https://attack.mitre.org/techniques/T1566). While [User Execution](https://attack.mitre.org/techniques/T1204) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534). Adversaries may also deceive users into performing actions such as: * Enabling [Remote Access Tools](https://attack.mitre.org/techniques/T1219), allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539)s(Citation: Talos Roblox Scam 2023)(Citation: Krebs Discord Bookmarks 2023) * Downloading and executing malware for [User Execution](https://attack.mitre.org/techniques/T1204) * Coerceing users to copy, paste, and execute malicious code manually(Citation: Reliaquest-execution)(Citation: proofpoint-selfpwn) For example, tech support scams can be facilitated through [Phishing](https://attack.mitre.org/techniques/T1566), vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or [Remote Access Tools](https://attack.mitre.org/techniques/T1219).(Citation: Telephone Attack Delivery)

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

• CVE-2025-24993
• CVE-2023-38831

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-09-29 Microsoft Threat Intelligence: Phishing Abuses RMM Tools for Persistent Access
• 2026-09-03 Recorded Future Insikt: H1 2026 Malware Vulnerability Trends
• 2026-08-23 Darktrace: When AI Becomes the Lure: A Fake Gemini Installer Delivers Vidar
• 2026-08-13 Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them

Detection coverage

SigmaHQ community rules

• Potential Snatch Ransomware Activity (emerging-threats)
• PrinterNightmare Mimikatz Driver Name (emerging-threats)
• DarkSide Ransomware Pattern (emerging-threats)
• Antivirus - Hacktool Signature (core)
• Payload Decoded and Decrypted via Built-in Utilities (core)
• Suspicious Execution via macOS Script Editor (core)
• Suspicious Deno File Written from Remote Source (core)
• Suspicious Binaries and Scripts in Public Folder (core)
• Arbitrary Shell Command Execution Via Settingcontent-Ms (core)
• Potentially Suspicious WebDAV LNK Execution (core)

Elastic and Splunk rules

• Masquerading Space After Filename (elastic)
• Elastic Defend Alert Followed by Telemetry Loss (elastic)
• Node.js Pre or Post-Install Script Execution (elastic)
• Potential Widespread Malware Infection Across Multiple Hosts (elastic)
• GenAI Agent Instruction File Written to Downloads (elastic)
• Decoded Payload Piped to Interpreter Detected via Defend for Containers (elastic)
• Ingress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers (elastic)
• Encoded Payload Detected via Defend for Containers (elastic)
• Malicious File - Detected - Elastic Defend (elastic)
• Malicious File - Prevented - Elastic Defend (elastic)
• Google Workspace Object Copied from External Drive with App Consent (elastic)
• Unusual Base64 Encoding/Decoding Activity (elastic)
• Potential Hex Payload Execution via Command-Line (elastic)
• Potential Hex Payload Execution via Common Utility (elastic)
• Base64 Decoded Payload Piped to Interpreter (elastic)
• Multi-Base64 Decoding Attempt from Suspicious Location (elastic)
• XDG-Open Command Execution (elastic)
• Executable File Download via Wget (elastic)
• Gatekeeper Override and Execution (elastic)
• Suspicious macOS MS Office Child Process (elastic)
• Suspicious Apple Mail Rule Plist Modification (elastic)
• Spike in host-based traffic (elastic)
• Network Traffic to Rare Destination Country (elastic)
• Unusual Windows Path Activity (elastic)
• Anomalous Process For a Windows Population (elastic)

Showing 25 of 75.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.