An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing.
While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.
Adversaries may also deceive users into performing actions such as:
For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.(Citation: Telephone Attack Delivery)
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CIS-13.10 | Perform Application Layer Filtering | mitigates | T1204 | User Execution |
Comments
Application-layer filtering can prevent malicious web or email content from reaching users, reducing opportunities for users to execute or interact with adversary-delivered content.
References
|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1204 | User Execution |
Comments
Host-based intrusion prevention capabilities can prevent potentially malicious executable files from running based on prevalence, age, trust, or behavioral criteria and can block Office applications from writing malicious executable content to disk.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1204 | User Execution |
Comments
When user execution depends on visiting a malicious link or retrieving malicious content, network intrusion prevention solutions can block the associated network request or download.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1204 | User Execution |
Comments
Blocking malicious attachments prevents one major form of user execution.
References
|
| CIS-9.6 | Block Unnecessary File Types | mitigates | T1204 | User Execution |
Comments
9.6 enforcement can reduce user exposure by removing risky files upstream at the point of email delivery.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1204 | User Execution |
Comments
Non-allowlisted executables cannot run, directly preventing execution of malicious binaries delivered via user interaction.
References
|
| CIS-9.3 | Maintain and Enforce Network-Based URL Filters | mitigates | T1204 | User Execution |
Comments
9.3 helps prevent link-based and web-based initial access by stopping users from reaching malicious or unapproved content in the first place. It does this by requiring updated network-based URL filtering across all enterprise assets, using methods such as category-based filtering, reputation-based filtering, and block lists. In practice, this means enforcing controls that restrict access to unsafe websites, malicious downloads, risky scripts, and unauthorized browser extensions, reducing the risk of phishing, exploitation, and malware delivery. If 9.3 is implemented as a secure web gateway or proxy that can stop the post-click fetch/download, then this technique is applicable.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| google_secops | Google Security Operations | technique_scores | T1204 | User Execution |
Comments
Google Security Ops is able to trigger an alert based on suspicious user activity (e.g., clicking on a malicious links).
This technique was scored as minimal based on low or uncertain detection coverage factor.
https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/soc_prime_rules/threat_hunting/proxy/microsoft_teams_phishing_email.yaral
https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/soc_prime_rules/threat_hunting/process_creation/detect_possible_execution_of_phishing_attachment.yaral
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| aws_config | AWS Config | technique_scores | T1204 | User Execution |
Comments
This control provides significant coverage for one of this technique's sub-techniques, resulting in an overall score of Minimal.
References
|
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1204.002 | Malicious File | 9 |
| T1204.005 | Malicious Library | 3 |
| T1204.003 | Malicious Image | 6 |
| T1204.004 | Malicious Copy and Paste | 3 |
| T1204.001 | Malicious Link | 6 |