THREATNOIR
Subscribe
MITRE ATT&CK · T1204.002

Malicious File

MITRE · cited in 32 of our lessons

Explanation

What attackers do. Attackers rely on a user opening a malicious file, such as a document, script, shortcut or installer, to run their code. It usually follows phishing or a fake download and serves the Execution tactic.

How to defend. Use application control to block unapproved executables and scripts from user-writable locations, and keep protective file markings so downloaded files get extra scrutiny. Disable macros from the internet and change default file associations for script types so they open in a text editor. Train users to report unexpected files, and use endpoint detection to watch what opened files launch.

Signs to look for. Look for processes started from Downloads, temp or email cache folders, shortcut or script files launching interpreters, and Office applications spawning shells. Gaps often involve less common file types that are not covered by attachment filters.

Open the technique on MITRE ATT&CK
The official text
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso. Adversaries may employ various forms of Masquerading and Obfuscated Files or Information to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it. While Malicious File frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 32.