THREATNOIR
Subscribe
MITRE ATT&CK · T1203

Exploitation for Client Execution

MITRE · cited in 21 of our lessons

Explanation

What attackers do. Attackers exploit vulnerabilities in client software, such as browsers, document readers, office suites or messaging apps, to run code when a user opens content or visits a page. This serves the Execution tactic and often follows phishing or a drive-by compromise.

How to defend. Patch browsers, office suites and readers quickly and automatically, and remove unneeded client software and plugins. Enable exploit protection and sandboxing features, and open untrusted documents in protected or isolated views. Endpoint detection should watch what client applications spawn.

Signs to look for. Look for client applications crashing and then spawning unusual child processes, writing executables to disk or making unexpected network connections. A common gap is slow patching of less visible client software such as PDF tools or chat applications.

Open the technique on MITRE ATT&CK
The official text
Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility. Several types exist: ### Browser-based Exploitation

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 21.