kevmap

Techniques › T1204 › T1204.001

T1204.001 Malicious Link

execution — Linux, macOS, Windows · attack.mitre.org · JSON

1
MITRE detection strategy
3
analytics
4
Sigma rules tagged attack.t1204.001
11
KEV CVEs mapped here
<p>An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution. Links may also lead users to download files that require execution via Malicious File.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

CVEVendor / productMapping typeStateAdded
CVE-2024-38112Microsoft Windows exploitation technique Mapped2024-07-09
CVE-2023-5631Roundcube Webmail exploitation technique Mapped2023-10-26
CVE-2023-5217Google Chromium libvpx exploitation technique Mapped2023-10-02
CVE-2023-2136Google Chromium Skia exploitation technique Mapped2023-04-21
CVE-2022-3038Google Chromium Network Service exploitation technique Mapped2023-03-30
CVE-2022-3075Google Chromium Mojo exploitation technique Mapped2022-09-08
CVE-2022-21971Microsoft Windows exploitation technique Mapped2022-08-18
CVE-2012-0767Adobe Flash Player exploitation technique Mapped2022-06-08
CVE-2015-5119Adobe Flash Player exploitation technique Mapped2022-03-03
CVE-2022-24682Synacor Zimbra Collaborate Suite (ZCS) exploitation technique Mapped2022-02-25
CVE-2020-3580Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) exploitation technique Mapped2021-11-03

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1204.001

Suspicious Execution via macOS Script Editor mediumtest
Author: Tim Rauch (rule), Elastic (idea) · 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4
Detects when the macOS Script Editor utility spawns an unusual child process.
Techniques: T1566T1566.002T1059T1059.002T1204T1204.001T1553
Symlink Etc Passwd hightest
Author: Florian Roth (Nextron Systems) · 2019-04-05 (modified 2021-11-27) · logsource: product=linux · c67fc22a-0be5-4b4f-aad5-2b32c4b69523
Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd
Techniques: T1204.001
Suspicious ClickFix/FileFix Execution Pattern highexperimental
Author: montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-19 · logsource: product=windows category=process_creation · d487ed4a-fd24-436d-a0b2-f4e95f7b2635
Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix). Attackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems.
Techniques: T1204.001T1204.004
Potential ClickFix Execution Pattern - Registry highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-03-25 (modified 2025-11-19) · logsource: product=windows category=registry_set · f5fe36cf-f1ec-4c23-903d-09a3110f6bbb
Detects potential ClickFix malware execution patterns by monitoring registry modifications in RunMRU keys containing HTTP/HTTPS links. ClickFix is known to be distributed through phishing campaigns and uses techniques like clipboard hijacking and fake CAPTCHA pages. Through the fakecaptcha pages, the adversary tricks users into opening the Run dialog box and pasting clipboard-hijacked content, such as one-liners that execute remotely hosted malicious files or scripts.
Techniques: T1204.001

Rules tagged at the parent level (attack.t1204) 10

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Potentially Suspicious WebDAV LNK Execution mediumtest
Author: Micah Babinski · 2023-08-21 · logsource: product=windows category=process_creation · 1412aa78-a24c-4abd-83df-767dfb2c5bbe
Detects possible execution via LNK file accessed on a WebDAV server.
Techniques: T1059.001T1204
Payload Decoded and Decrypted via Built-in Utilities mediumtest
Author: Tim Rauch (rule), Elastic (idea) · 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Techniques: T1059T1204T1140
Arbitrary Shell Command Execution Via Settingcontent-Ms mediumtest
Author: Sreeman · 2020-03-13 (modified 2022-04-14) · logsource: product=windows category=process_creation · 24de4f3b-804c-4165-b442-5a06a2302c7e
The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.
Techniques: T1204T1566.001
Potential Snatch Ransomware Activity highstable
Author: Florian Roth (Nextron Systems) · 2020-08-26 (modified 2025-10-19) · logsource: product=windows category=process_creation · 5325945e-f1f0-406e-97b8-65104d393fff
Detects specific process characteristics of Snatch ransomware word document droppers
Techniques: T1204
Suspicious Deno File Written from Remote Source lowexperimental
Author: Josh Nickels, Michael Taggart · 2025-05-22 · logsource: product=windows category=file_event · 6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e
Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL. This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
Techniques: T1204T1059.007T1105
Suspicious Execution via macOS Script Editor mediumtest
Author: Tim Rauch (rule), Elastic (idea) · 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4
Detects when the macOS Script Editor utility spawns an unusual child process.
Techniques: T1566T1566.002T1059T1059.002T1204T1204.001T1553
DarkSide Ransomware Pattern criticaltest
Author: Florian Roth (Nextron Systems) · 2021-05-14 · logsource: product=windows category=process_creation · 965fff6c-1d7e-4e25-91fd-cdccd75f7d2c
Detects DarkSide Ransomware and helpers
Techniques: T1204
Suspicious Binaries and Scripts in Public Folder highexperimental
Author: The DFIR Report · 2025-01-23 · logsource: product=windows category=file_event · b447f7de-1e53-4cbf-bfb4-f1f6d0b04e4e
Detects the creation of a file with a suspicious extension in the public folder, which could indicate potential malicious activity.
Techniques: T1204
PrinterNightmare Mimikatz Driver Name criticaltest
Author: Markus Neis, @markus_neis, Florian Roth · 2021-07-04 (modified 2023-06-12) · logsource: product=windows category=registry_event · ba6b9e43-1d45-4d3c-a504-1043a64c8469
Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527
Techniques: T1204
CVE tags: CVE-2021-1675CVE-2021-34527
Antivirus - Hacktool Signature highstable
Author: Florian Roth (Nextron Systems), Arnim Rupp · 2021-08-16 (modified 2026-06-15) · logsource: category=antivirus · fa0c05b6-8ad3-468d-8231-c1cbccb64fba
Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Techniques: T1204