[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1204":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1204","T1204","User Execution",16,"MITRE","**What attackers do.** Attackers depend on a user doing something, such as opening a file, clicking a link, running a pasted command or launching an image, to start their code. Social engineering is the usual lever, and the technique serves the Execution tactic.\n\n**How to defend.** Reduce what users can run with application control, keep protective file markings, and block common malicious file types. Train staff to recognise lures, including fake fixes that ask them to paste commands into a terminal. Endpoint detection should watch what user-launched files and pasted commands lead to.\n\n**Signs to look for.** Look for scripts or executables started from download or temp folders, shells launched from the Run dialog with long commands, and browsers or email clients spawning interpreters. A common gap is assuming users will not run commands themselves.","An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing.\n\nWhile User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.\n\nAdversaries may also deceive users into performing actions such as:","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1204\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"romulus-malware-platform-exploits-human-deception-via-clickfix-lures","ROMULUS Malware Platform Exploits Human Deception via ClickFix Lures","2026-10-16T15:20:34.428+00:00",{"slug":25,"title":26,"published_at":27},"fake-ai-tools-used-to-distribute-malware-and-steal-business-credentials","Fake AI Tools Used to Distribute Malware and Steal Business Credentials","2026-10-15T14:21:08.398+00:00",{"slug":29,"title":30,"published_at":31},"on-machine-cryptominer-compilation-exposes-attackers-who-exploited-unpatched-cve","On-Machine Cryptominer Compilation Exposes Attackers Who Exploited Unpatched CVE","2026-09-25T14:21:02.041+00:00",{"slug":33,"title":34,"published_at":35},"macsync-malware-hijacks-icloud-calendars-to-deliver-payloads","MacSync Malware Hijacks iCloud Calendars to Deliver Payloads","2026-09-24T22:20:58.618+00:00",{"slug":37,"title":38,"published_at":39},"clickfix-social-engineering-turns-trusted-interfaces-into-malware-entry-points","ClickFix Social Engineering Turns Trusted Interfaces Into Malware Entry Points","2026-09-24T12:22:18.518+00:00",{"slug":41,"title":42,"published_at":43},"avisloader-exploits-clickfix-social-engineering-and-tox-p2p-for-resilient-c2","AvisLoader Exploits ClickFix Social Engineering and Tox P2P for Resilient C2","2026-09-24T10:20:39.211+00:00",{"slug":45,"title":46,"published_at":47},"fake-job-recruiters-drain-1071m-in-crypto-via-malware-campaign","Fake Job Recruiters Drain $10.71M in Crypto via Malware Campaign","2026-09-21T20:21:06.891+00:00",{"slug":49,"title":50,"published_at":51},"moviereaper-trojan-spreads-via-compromised-torrents-using-blockchain-c2","MovieReaper Trojan Spreads via Compromised Torrents Using Blockchain C2","2026-09-17T14:20:53.271+00:00",{"slug":53,"title":54,"published_at":55},"clickfix-campaigns-use-trusted-cloud-services-to-trick-users-and-evade-detection","ClickFix Campaigns Use Trusted Cloud Services to Trick Users and Evade Detection","2026-09-08T18:20:39.611+00:00",{"slug":57,"title":58,"published_at":59},"clickfix-abuses-polygon-blockchain-to-hide-c2-infrastructure-across-31-orgs","ClickFix Abuses Polygon Blockchain to Hide C2 Infrastructure Across 31 Orgs","2026-09-01T16:21:50.475+00:00",{"slug":61,"title":62,"published_at":63},"attackers-favor-repeatable-scalable-techniques-over-novel-exploits","Attackers Favor Repeatable, Scalable Techniques Over Novel Exploits","2026-09-01T12:20:42.078+00:00",{"slug":65,"title":66,"published_at":67},"stack-overflow-in-siemens-simcenter-nastran-enables-remote-code-execution","Stack Overflow in Siemens Simcenter Nastran Enables Remote Code Execution","2026-08-18T18:20:57.621+00:00",[69,73,78,83,88,93],{"slug":70,"name":71,"problem":72,"stories":9},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":74,"name":75,"problem":76,"stories":77},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",10,{"slug":79,"name":80,"problem":81,"stories":82},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",8,{"slug":84,"name":85,"problem":86,"stories":87},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",5,{"slug":89,"name":90,"problem":91,"stories":92},"patch-management","Automated patch management","Known holes get closed in days, not months.",2,{"slug":94,"name":95,"problem":96,"stories":97},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",1,[99,105,109,115,120,124,129,135],{"family":100,"item":101,"code":102,"title":103,"together":104},"nist-800-53","si-3","SI-3","Malicious Code Protection",14,{"family":100,"item":106,"code":107,"title":108,"together":104},"at-2","AT-2","Literacy Training and Awareness",{"family":110,"item":111,"code":112,"title":113,"together":114},"cis","2","Control 2","Inventory and Control of Software Assets",12,{"family":110,"item":116,"code":117,"title":118,"together":119},"14","Control 14","Security Awareness and Skills Training",11,{"family":110,"item":121,"code":122,"title":123,"together":77},"9","Control 9","Email and Web Browser Protections",{"family":110,"item":125,"code":126,"title":127,"together":128},"13","Control 13","Network Monitoring and Defense",9,{"family":130,"item":131,"code":132,"title":133,"together":134},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",7,{"family":136,"item":137,"code":138,"title":139,"together":140},"gdpr","32","Article 32","Security of processing",6]