THREATNOIR
Subscribe
MITRE ATT&CK · T1204

User Execution

MITRE · cited in 16 of our lessons

Explanation

What attackers do. Attackers depend on a user doing something, such as opening a file, clicking a link, running a pasted command or launching an image, to start their code. Social engineering is the usual lever, and the technique serves the Execution tactic.

How to defend. Reduce what users can run with application control, keep protective file markings, and block common malicious file types. Train staff to recognise lures, including fake fixes that ask them to paste commands into a terminal. Endpoint detection should watch what user-launched files and pasted commands lead to.

Signs to look for. Look for scripts or executables started from download or temp folders, shells launched from the Run dialog with long commands, and browsers or email clients spawning interpreters. A common gap is assuming users will not run commands themselves.

Open the technique on MITRE ATT&CK
The official text
An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as:

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 16.