kevmap

Techniques › T1204

T1204 User Execution

execution — Linux, Windows, macOS, IaaS, Containers · attack.mitre.org · JSON

1
MITRE detection strategy
5
analytics
10
Sigma rules tagged attack.t1204
2
KEV CVEs mapped here
<p>An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing.</p><p>While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.</p><p>Adversaries may also deceive users into performing actions such as:</p>
    <li>Enabling Remote Access Tools, allowing direct control of the system to the adversary</li><li>Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies</li><li>Downloading and executing malware for User Execution</li><li>Coerceing users to copy, paste, and execute malicious code manually</li>
<p>For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

CVEVendor / productMapping typeStateAdded
CVE-2025-24993Microsoft Windows exploitation technique Mapped2025-03-11
CVE-2023-38831RARLAB WinRAR exploitation technique Mapped2023-08-24

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1204

Potentially Suspicious WebDAV LNK Execution mediumtest
Author: Micah Babinski · 2023-08-21 · logsource: product=windows category=process_creation · 1412aa78-a24c-4abd-83df-767dfb2c5bbe
Detects possible execution via LNK file accessed on a WebDAV server.
Techniques: T1059.001T1204
Payload Decoded and Decrypted via Built-in Utilities mediumtest
Author: Tim Rauch (rule), Elastic (idea) · 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Techniques: T1059T1204T1140
Arbitrary Shell Command Execution Via Settingcontent-Ms mediumtest
Author: Sreeman · 2020-03-13 (modified 2022-04-14) · logsource: product=windows category=process_creation · 24de4f3b-804c-4165-b442-5a06a2302c7e
The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.
Techniques: T1204T1566.001
Potential Snatch Ransomware Activity highstable
Author: Florian Roth (Nextron Systems) · 2020-08-26 (modified 2025-10-19) · logsource: product=windows category=process_creation · 5325945e-f1f0-406e-97b8-65104d393fff
Detects specific process characteristics of Snatch ransomware word document droppers
Techniques: T1204
Suspicious Deno File Written from Remote Source lowexperimental
Author: Josh Nickels, Michael Taggart · 2025-05-22 · logsource: product=windows category=file_event · 6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e
Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL. This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
Techniques: T1204T1059.007T1105
Suspicious Execution via macOS Script Editor mediumtest
Author: Tim Rauch (rule), Elastic (idea) · 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4
Detects when the macOS Script Editor utility spawns an unusual child process.
Techniques: T1566T1566.002T1059T1059.002T1204T1204.001T1553
DarkSide Ransomware Pattern criticaltest
Author: Florian Roth (Nextron Systems) · 2021-05-14 · logsource: product=windows category=process_creation · 965fff6c-1d7e-4e25-91fd-cdccd75f7d2c
Detects DarkSide Ransomware and helpers
Techniques: T1204
Suspicious Binaries and Scripts in Public Folder highexperimental
Author: The DFIR Report · 2025-01-23 · logsource: product=windows category=file_event · b447f7de-1e53-4cbf-bfb4-f1f6d0b04e4e
Detects the creation of a file with a suspicious extension in the public folder, which could indicate potential malicious activity.
Techniques: T1204
PrinterNightmare Mimikatz Driver Name criticaltest
Author: Markus Neis, @markus_neis, Florian Roth · 2021-07-04 (modified 2023-06-12) · logsource: product=windows category=registry_event · ba6b9e43-1d45-4d3c-a504-1043a64c8469
Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527
Techniques: T1204
CVE tags: CVE-2021-1675CVE-2021-34527
Antivirus - Hacktool Signature highstable
Author: Florian Roth (Nextron Systems), Arnim Rupp · 2021-08-16 (modified 2026-06-15) · logsource: category=antivirus · fa0c05b6-8ad3-468d-8231-c1cbccb64fba
Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Techniques: T1204

Sub-techniques

IDNameSigma rulesKEV CVEs
T1204.001Malicious Link411
T1204.002Malicious File3933
T1204.003Malicious Image00
T1204.004Malicious Copy and Paste60
T1204.005Malicious Library00