T1204.002 Malicious File

About this technique

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.

Adversaries may employ various forms of Masquerading and Obfuscated Files or Information to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.

While Malicious File frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.

Detection rules57

Rules on DetectionCode tagged with T1204.002.

Sigma30

Rule	Level	Log source
File With Uncommon Extension Created By An Office Application	high	windows / file_event
Flash Player Update from Suspicious Location	high	NULL / proxy
GAC DLL Loaded Via Office Applications	high	windows / image_load
HackTool - LittleCorporal Generated Maldoc Injection	high	windows / process_access
MMC Executing Files with Reversed Extensions Using RTLO Abuse	high	windows / process_creation
Suspicious Binary In User Directory Spawned From Office Application	high	windows / process_creation
Suspicious LNK Command-Line Padding with Whitespace Characters	high	windows / process_creation
Suspicious Microsoft Office Child Process	high	windows / process_creation
Suspicious Microsoft Office Child Process - MacOS	high	macos / process_creation
Suspicious Outlook Child Process	high	windows / process_creation
Suspicious Startup Folder Persistence	high	windows / file_event
Suspicious WMIC Execution Via Office Process	high	windows / process_creation
Suspicious WmiPrvSE Child Process	high	windows / process_creation
VBA DLL Loaded Via Office Application	high	windows / image_load
Active Directory Kerberos DLL Loaded Via Office Application	medium	windows / image_load
Active Directory Parsing DLL Loaded Via Office Application	medium	windows / image_load
AppLocker Application Would Have Been Blocked	medium	windows / NULL
AppLocker Prevented Application or Script from Running	medium	windows / NULL
CLR DLL Loaded Via Office Applications	medium	windows / image_load
DotNET Assembly DLL Loaded Via Office Application	medium	windows / image_load
Microsoft Excel Add-In Loaded From Uncommon Location	medium	windows / image_load
Microsoft VBA For Outlook Addin Loaded Via Outlook	medium	windows / image_load
Potential Suspicious Browser Launch From Document Reader Process	medium	windows / process_creation
Remote DLL Load Via Rundll32.EXE	medium	windows / image_load
Windows AppX Deployment Full Trust Package Installation	medium	windows / NULL
Windows AppX Deployment Unsigned Package Installation	medium	windows / NULL
Download From Suspicious TLD - Blacklist	low	NULL / proxy
Download From Suspicious TLD - Whitelist	low	NULL / proxy
Windows MSIX Package Support Framework AI_STUBS Execution	low	windows / process_creation
New Application in AppCompat	informational	windows / registry_set

Splunk27

Rule	Type	Risk	Data source
Batch File Write to System32	Anomaly	NULL	Sysmon EventID 11
Cisco NVM - Susp Script From Archive Triggering Network Activity	Anomaly	NULL	Cisco Network Visibility Module Flow Data
Drop IcedID License dat	Hunting	NULL	Sysmon EventID 11
Linux Ghostscript Exploitation	TTP	NULL	Sysmon for Linux EventID 1
O365 SharePoint Malware Detection	TTP	NULL	Office 365 Universal Audit Log
O365 Threat Intelligence Suspicious File Detected	TTP	NULL	Office 365 Universal Audit Log
Single Letter Process On Endpoint	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Suspicious Process Executed From Container File	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Uncommon Processes On Endpoint	Hunting	NULL	Sysmon EventID 1
Windows Advanced Installer MSIX with AI_STUBS Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows AppX Deployment Full Trust Package Installation	Hunting	NULL	Windows Event Log AppXDeployment-Server 400
Windows AppX Deployment Package Installation Success	Anomaly	NULL	Windows Event Log AppXDeployment-Server 854
Windows AppX Deployment Unsigned Package Installation	TTP	NULL	Windows Event Log AppXDeployment-Server 855
Windows Binary Execution from an Archive	Anomaly	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2
Windows Default Cobalt Strike PowerShell Beacon	TTP	NULL	Powershell Script Block Logging 4104
Windows Developer-Signed MSIX Package Installation	Anomaly	NULL	Windows Event Log AppXDeployment-Server 855
Windows EFI Volume Mount Attempt Via Mountvol	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Explorer LNK Exploit Process Launch With Padding	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688
Windows Explorer.exe Spawning PowerShell or Cmd	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688
Windows MSIX Package Interaction	Hunting	NULL	Windows Event Log AppXPackaging 171
Windows Mustang Panda USB Tool Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows NorthStar C2 Agent Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows PowerShell Script From WindowsApps Directory	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Suspect Process With Authentication Traffic	Anomaly	NULL	Sysmon EventID 3
Windows Suspicious QEMU Execution	TTP	NULL	Sysmon EventID 1
Windows Universal Data Link File Creation	Anomaly	NULL	Sysmon EventID 11
Windows User Execution Malicious URL Shortcut File	Anomaly	NULL	Sysmon EventID 11

Groups86

Show 62 more

Software98

Show 74 more

Campaigns12

2015 Ukraine Electric Power Attack C0011 C0015 Frankenstein Operation AkaiRyū Operation Dream Job Operation Dust Storm Operation Honeybee Operation Sharpshooter Operation Spalax RedDelta Modified PlugX Infection Chain Operations Water Curupira Pikabot Distribution

Procedure examples196

Groups86

Used by	Procedure example
Groupadmin@338	admin@338 has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails. FireEye admin@338
GroupAjax Security Team	Ajax Security Team has lured victims into executing malicious files. FireEye Operation Saffron Rose 2013
GroupAndariel	Andariel has attempted to lure victims into enabling malicious macros within email attachments. AhnLab Andariel Subgroup of Lazarus June 2018
GroupAoqin Dragon	Aoqin Dragon has lured victims into opening weaponized documents, fake external drives, and fake antivirus to execute malicious payloads. SentinelOne Aoqin Dragon June 2022
GroupAPT-C-36	APT-C-36 has prompted victims to open attachments and to accept macros in order to execute the subsequent payload. APT-C-36 has also lured victims into opening malicious files hosted on Google Drive that triggered WebDAV requests to download malware. Check Point Blind Eagle MAR 2025 QiAnXin APT-C-36 Feb2019 Recorded Future TAG-144 AUG 2025 Zscaler BlindEagle DEC 2025
GroupAPT12	APT12 has attempted to get victims to open malicious Microsoft Word and PDF attachment sent via spearphishing. Moran 2014 Trend Micro IXESHE 2012
GroupAPT19	APT19 attempted to get users to launch malicious attachments delivered via spearphishing emails. FireEye APT19
GroupAPT28	APT28 attempted to get users to click on Microsoft Office attachments containing malicious macro scripts. Accenture SNAKEMACKEREL Nov 2018 Cato LAMEHUG JUL 2025 Secureworks IRON TWILIGHT Active Measures March 2017 Unit 42 Sofacy Feb 2018

View all 86 groups examples

Software98

Used by	Procedure example
MalwareAgent Tesla	Agent Tesla has been executed through malicious e-mail attachments Bitdefender Agent Tesla April 2020
MalwareAppleJeus	AppleJeus has required user execution of a malicious MSI installer. CISA AppleJeus Feb 2021
MalwareAppleSeed	AppleSeed can achieve execution through users running malicious file attachments distributed via email. Malwarebytes Kimsuky June 2021
MalwareAshTag	AshTag has been executed through victims downloading and opening malicious RAR archive files. Palo Alto Ashen Lepus DEC 2025
MalwareAstaroth	Astaroth has used malicious files including VBS, LNK, and HTML for execution. Securelist Brazilian Banking Malware July 2020
ToolAsyncRAT	AsyncRAT has been executed through victims opening malicious file attachments. Recorded Future TAG-144 AUG 2025
MalwareBad Rabbit	Bad Rabbit has been executed through user installation of an executable disguised as a flash installer. ESET Bad Rabbit Secure List Bad Rabbit
MalwareBADFLICK	BADFLICK has relied upon users clicking on a malicious attachment delivered through spearphishing. Accenture MUDCARP March 2019

View all 98 software examples

Campaigns12

Used by	Procedure example
Campaign2015 Ukraine Electric Power Attack	During the 2015 Ukraine Electric Power Attack, Sandworm Team leveraged Microsoft Office attachments which contained malicious macros that were automatically executed once the user permitted them. Ukraine15 - EISAC - 201603
CampaignC0011	During C0011, Transparent Tribe relied on a student target to open a malicious document delivered via email. Cisco Talos Transparent Tribe Education Campaign July 2022
CampaignC0015	During C0015, the threat actors relied on users to enable macros within a malicious Microsoft Word document. DFIR Conti Bazar Nov 2021
CampaignFrankenstein	During Frankenstein, the threat actors relied on a victim to enable macros within a malicious Microsoft Word document likely sent via email. Talos Frankenstein June 2019
CampaignOperation AkaiRyū	During Operation AkaiRyū, MirrorFace lured victims into executing malicious payloads by opening email attachments. ESET MirrorFace 2025
CampaignOperation Dream Job	During Operation Dream Job, Lazarus Group lured victims into executing malicious documents that contained "dream job" descriptions from defense, aerospace, and other sectors. ClearSky Lazarus Aug 2020 McAfee Lazarus Jul 2020
CampaignOperation Dust Storm	During Operation Dust Storm, the threat actors relied on potential victims to open a malicious Microsoft Word document sent via email. Cylance Dust Storm
CampaignOperation Honeybee	During Operation Honeybee, threat actors relied on a victim to enable macros within a malicious Word document. McAfee Honeybee

View all 12 campaigns examples

References2

Mandiant Trojanized Windows 10 Open source
Mandiant Intelligence. (2022, December 15). Trojanized Windows 10 Operating System Installers Targeted Ukrainian Government. Retrieved September 26, 2025.
Password Protected Word Docs Open source
Lawrence Abrams. (2017, July 12). PSA: Don't Open SPAM Containing Password Protected Word Docs. Retrieved January 5, 2022.