[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1204-002":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1204-002","T1204.002","Malicious File",32,"MITRE","**What attackers do.** Attackers rely on a user opening a malicious file, such as a document, script, shortcut or installer, to run their code. It usually follows phishing or a fake download and serves the Execution tactic.\n\n**How to defend.** Use application control to block unapproved executables and scripts from user-writable locations, and keep protective file markings so downloaded files get extra scrutiny. Disable macros from the internet and change default file associations for script types so they open in a text editor. Train users to report unexpected files, and use endpoint detection to watch what opened files launch.\n\n**Signs to look for.** Look for processes started from Downloads, temp or email cache folders, shortcut or script files launching interpreters, and Office applications spawning shells. Gaps often involve less common file types that are not covered by attachment filters.","An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.\n\nAdversaries may employ various forms of Masquerading and Obfuscated Files or Information to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and\u002For password protecting the file and supplying instructions to a user on how to open it. \n\nWhile Malicious File frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1204\u002F002\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"fake-ai-brand-impersonation-campaigns-target-enterprise-developers","Fake AI Brand Impersonation Campaigns Target Enterprise Developers","2026-10-16T22:20:50.472+00:00",{"slug":25,"title":26,"published_at":27},"fake-claude-ai-ads-trick-users-into-running-malware-via-clickfix","Fake Claude AI Ads Trick Users into Running Malware via ClickFix","2026-10-09T22:20:47.165+00:00",{"slug":29,"title":30,"published_at":31},"malicious-spreadsheets-exploit-libreoffice-openoffice-to-run-code-silently","Malicious Spreadsheets Exploit LibreOffice & OpenOffice to Run Code Silently","2026-10-06T12:20:27.3+00:00",{"slug":33,"title":34,"published_at":35},"clickfix-attack-abuses-browser-cache-to-smuggle-malicious-payloads","ClickFix Attack Abuses Browser Cache to Smuggle Malicious Payloads","2026-10-06T08:21:47.852+00:00",{"slug":37,"title":38,"published_at":39},"fake-chatgpt-custom-gpts-used-to-spread-remote-access-trojans-via-clickfix-lures","Fake ChatGPT Custom GPTs Used to Spread Remote Access Trojans via ClickFix Lures","2026-09-30T16:22:19.003+00:00",{"slug":41,"title":42,"published_at":43},"russian-apt-star-blizzard-deploys-redflick-malware-via-spear-phishing","Russian APT Star Blizzard Deploys RedFlick Malware via Spear-Phishing","2026-09-30T12:21:47.221+00:00",{"slug":45,"title":46,"published_at":47},"fake-chatgpt-ads-use-clickfix-to-deploy-remote-access-trojans","Fake ChatGPT Ads Use ClickFix to Deploy Remote Access Trojans","2026-09-29T22:21:13.221+00:00",{"slug":49,"title":50,"published_at":51},"chatgpt-custom-gpts-weaponized-in-clickfix-social-engineering-campaign","ChatGPT Custom GPTs Weaponized in ClickFix Social Engineering Campaign","2026-09-29T14:20:43.365+00:00",{"slug":53,"title":54,"published_at":55},"siemens-desigo-cc-unpatched-cce-vulnerability-enables-arbitrary-code-execution-via-malicious-graphic","Siemens Desigo CC Unpatched CCE Vulnerability Enables Arbitrary Code Execution via Malicious Graphics","2026-09-22T16:22:52.198+00:00",{"slug":57,"title":58,"published_at":59},"terminalfix-malware-uses-fake-captchas-to-trick-users-into-opening-reverse-tunnels","TerminalFix Malware Uses Fake CAPTCHAs to Trick Users into Opening Reverse Tunnels","2026-08-31T20:20:31.988+00:00",{"slug":61,"title":62,"published_at":63},"fake-captcha-lures-users-into-running-malicious-commands","Fake CAPTCHA Lures Users Into Running Malicious Commands","2026-08-30T10:20:21.007+00:00",{"slug":65,"title":66,"published_at":67},"fake-minecraft-sites-spread-weedhack-malware-via-seo-poisoning","Fake Minecraft Sites Spread Weedhack Malware via SEO Poisoning","2026-08-25T00:20:50.955+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",31,{"slug":75,"name":76,"problem":77,"stories":78},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",23,{"slug":80,"name":81,"problem":82,"stories":83},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",18,{"slug":85,"name":86,"problem":87,"stories":88},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",9,{"slug":90,"name":91,"problem":92,"stories":93},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",4,{"slug":95,"name":96,"problem":97,"stories":93},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[99,104,109,115,119,124,129,134],{"family":100,"item":101,"code":102,"title":103,"together":73},"nist-800-53","si-3","SI-3","Malicious Code Protection",{"family":100,"item":105,"code":106,"title":107,"together":108},"at-2","AT-2","Literacy Training and Awareness",27,{"family":110,"item":111,"code":112,"title":113,"together":114},"cis","14","Control 14","Security Awareness and Skills Training",24,{"family":110,"item":116,"code":117,"title":118,"together":78},"2","Control 2","Inventory and Control of Software Assets",{"family":110,"item":120,"code":121,"title":122,"together":123},"9","Control 9","Email and Web Browser Protections",21,{"family":125,"item":126,"code":127,"title":128,"together":83},"gdpr","32","Article 32","Security of processing",{"family":100,"item":130,"code":131,"title":132,"together":133},"cm-7","CM-7","Least Functionality",12,{"family":110,"item":135,"code":136,"title":137,"together":138},"10","Control 10","Malware Defenses",11]