T1204 User Execution | DetectionCode

About this technique

An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing.

While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.

Adversaries may also deceive users into performing actions such as:

* Enabling Remote Access Tools, allowing direct control of the system to the adversary
* Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies
* Downloading and executing malware for User Execution
* Coerceing users to copy, paste, and execute malicious code manually

For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.

Detection rules115

Rules on DetectionCode tagged with T1204 or one of its sub-techniques.

Sigma47

Rule	Level	Log source	Technique
PrinterNightmare Mimikatz Driver Name	critical	windows / registry_event	T1204
Antivirus - Hacktool Signature	high	NULL / antivirus	T1204
File With Uncommon Extension Created By An Office Application	high	windows / file_event	T1204.002
FileFix - Command Evidence in TypedPaths	high	windows / registry_set	T1204.004
FileFix - Suspicious Child Process from Browser File Upload Abuse	high	windows / process_creation	T1204.004
Flash Player Update from Suspicious Location	high	NULL / proxy	T1204.002
GAC DLL Loaded Via Office Applications	high	windows / image_load	T1204.002
HackTool - LittleCorporal Generated Maldoc Injection	high	windows / process_access	T1204.002
MMC Executing Files with Reversed Extensions Using RTLO Abuse	high	windows / process_creation	T1204.002
Potential ClickFix Execution Pattern - Registry	high	windows / registry_set	T1204.001
Suspicious Binaries and Scripts in Public Folder	high	windows / file_event	T1204
Suspicious Binary In User Directory Spawned From Office Application	high	windows / process_creation	T1204.002
Suspicious ClickFix/FileFix Execution Pattern	high	windows / process_creation	T1204.001 T1204.004
Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix	high	windows / process_creation	T1204.004
Suspicious FileFix Execution Pattern	high	windows / process_creation	T1204.004
Suspicious LNK Command-Line Padding with Whitespace Characters	high	windows / process_creation	T1204.002
Suspicious Microsoft Office Child Process	high	windows / process_creation	T1204.002
Suspicious Microsoft Office Child Process - MacOS	high	macos / process_creation	T1204.002
Suspicious Outlook Child Process	high	windows / process_creation	T1204.002
Suspicious Space Characters in RunMRU Registry Path - ClickFix	high	windows / registry_set	T1204.004
Suspicious Space Characters in TypedPaths Registry Path - FileFix	high	windows / registry_set	T1204.004
Suspicious Startup Folder Persistence	high	windows / file_event	T1204.002
Suspicious WMIC Execution Via Office Process	high	windows / process_creation	T1204.002
Suspicious WmiPrvSE Child Process	high	windows / process_creation	T1204.002
Symlink Etc Passwd	high	linux / NULL	T1204.001
VBA DLL Loaded Via Office Application	high	windows / image_load	T1204.002
Active Directory Kerberos DLL Loaded Via Office Application	medium	windows / image_load	T1204.002
Active Directory Parsing DLL Loaded Via Office Application	medium	windows / image_load	T1204.002
AppLocker Application Would Have Been Blocked	medium	windows / NULL	T1204.002
AppLocker Prevented Application or Script from Running	medium	windows / NULL	T1204.002
Arbitrary Shell Command Execution Via Settingcontent-Ms	medium	windows / process_creation	T1204
CLR DLL Loaded Via Office Applications	medium	windows / image_load	T1204.002
DotNET Assembly DLL Loaded Via Office Application	medium	windows / image_load	T1204.002
Microsoft Excel Add-In Loaded From Uncommon Location	medium	windows / image_load	T1204.002
Microsoft VBA For Outlook Addin Loaded Via Outlook	medium	windows / image_load	T1204.002
Payload Decoded and Decrypted via Built-in Utilities	medium	macos / process_creation	T1204
Potential Suspicious Browser Launch From Document Reader Process	medium	windows / process_creation	T1204.002
Potentially Suspicious WebDAV LNK Execution	medium	windows / process_creation	T1204
Remote DLL Load Via Rundll32.EXE	medium	windows / image_load	T1204.002
Suspicious Execution via macOS Script Editor	medium	macos / process_creation	T1204 T1204.001
Windows AppX Deployment Full Trust Package Installation	medium	windows / NULL	T1204.002
Windows AppX Deployment Unsigned Package Installation	medium	windows / NULL	T1204.002
Download From Suspicious TLD - Blacklist	low	NULL / proxy	T1204.002
Download From Suspicious TLD - Whitelist	low	NULL / proxy	T1204.002
Suspicious Deno File Written from Remote Source	low	windows / file_event	T1204
Windows MSIX Package Support Framework AI_STUBS Execution	low	windows / process_creation	T1204.002
New Application in AppCompat	informational	windows / registry_set	T1204.002

Splunk68

Rule	Type	Risk	Data source	Technique
ASL AWS ECR Container Upload Outside Business Hours	Anomaly	NULL	ASL AWS CloudTrail	T1204.003
ASL AWS ECR Container Upload Unknown User	Anomaly	NULL	ASL AWS CloudTrail	T1204.003
AWS ECR Container Scanning Findings High	TTP	NULL	AWS CloudTrail DescribeImageScanFindings	T1204.003
AWS ECR Container Scanning Findings Low Informational Unknown	Anomaly	NULL	AWS CloudTrail DescribeImageScanFindings	T1204.003
AWS ECR Container Scanning Findings Medium	Anomaly	NULL	AWS CloudTrail DescribeImageScanFindings	T1204.003
AWS ECR Container Upload Outside Business Hours	Anomaly	NULL	AWS CloudTrail PutImage	T1204.003
AWS ECR Container Upload Unknown User	Anomaly	NULL	AWS CloudTrail PutImage	T1204.003
AWS Lambda UpdateFunctionCode	Hunting	NULL	AWS CloudTrail	T1204
Batch File Write to System32	Anomaly	NULL	Sysmon EventID 11	T1204.002
Cisco Isovalent - Non Allowlisted Image Use	Anomaly	NULL	Cisco Isovalent Process Exec	T1204.003
Cisco Isovalent - Pods Running Offensive Tools	Anomaly	NULL	Cisco Isovalent Process Exec	T1204.003
Cisco NVM - Susp Script From Archive Triggering Network Activity	Anomaly	NULL	Cisco Network Visibility Module Flow Data	T1204.002
Cisco Secure Firewall - Lumma Stealer Activity	TTP	NULL	Cisco Secure Firewall Threat Defense Intrusion Event	T1204
Clop Common Exec Parameter	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1204
Conti Common Exec parameter	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1204
Correlation by Repository and Risk	Correlation	NULL		T1204.003
Correlation by User and Risk	Correlation	NULL		T1204.003
Detect Rare Executables	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1204
Drop IcedID License dat	Hunting	NULL	Sysmon EventID 11	T1204.002
Kubernetes Anomalous Inbound Network Activity from Process	Anomaly	NULL		T1204
Kubernetes Anomalous Inbound Outbound Network IO	Anomaly	NULL		T1204
Kubernetes Anomalous Inbound to Outbound Network IO Ratio	Anomaly	NULL		T1204
Kubernetes Anomalous Outbound Network Activity from Process	Anomaly	NULL		T1204
Kubernetes Anomalous Traffic on Network Edge	Anomaly	NULL		T1204
Kubernetes Create or Update Privileged Pod	Anomaly	NULL	Kubernetes Audit	T1204
Kubernetes DaemonSet Deployed	Anomaly	NULL	Kubernetes Audit	T1204
Kubernetes Falco Shell Spawned	Anomaly	NULL	Kubernetes Falco	T1204
Kubernetes newly seen TCP edge	Anomaly	NULL		T1204
Kubernetes newly seen UDP edge	Anomaly	NULL		T1204
Kubernetes Node Port Creation	Anomaly	NULL	Kubernetes Audit	T1204
Kubernetes Pod Created in Default Namespace	Anomaly	NULL	Kubernetes Audit	T1204
Kubernetes Pod With Host Network Attachment	Anomaly	NULL	Kubernetes Audit	T1204
Kubernetes Previously Unseen Container Image Name	Anomaly	NULL		T1204
Kubernetes Previously Unseen Process	Anomaly	NULL		T1204
Kubernetes Process Running From New Path	Anomaly	NULL		T1204
Kubernetes Process with Anomalous Resource Utilisation	Anomaly	NULL		T1204
Kubernetes Process with Resource Ratio Anomalies	Anomaly	NULL		T1204
Kubernetes Shell Running on Worker Node	Anomaly	NULL		T1204
Kubernetes Shell Running on Worker Node with CPU Activity	Anomaly	NULL		T1204
Kubernetes Unauthorized Access	Anomaly	NULL	Kubernetes Audit	T1204
Linux Ghostscript Exploitation	TTP	NULL	Sysmon for Linux EventID 1	T1204.002
O365 SharePoint Malware Detection	TTP	NULL	Office 365 Universal Audit Log	T1204.002
O365 Threat Intelligence Suspicious File Detected	TTP	NULL	Office 365 Universal Audit Log	T1204.002
Revil Common Exec Parameter	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1204
Risk Rule for Dev Sec Ops by Repository	Correlation	NULL		T1204.003
Single Letter Process On Endpoint	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1204.002
Suspicious Process Executed From Container File	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1204.002
Uncommon Processes On Endpoint	Hunting	NULL	Sysmon EventID 1	T1204.002
Windows Advanced Installer MSIX with AI_STUBS Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1204.002
Windows AppX Deployment Full Trust Package Installation	Hunting	NULL	Windows Event Log AppXDeployment-Server 400	T1204.002
Windows AppX Deployment Package Installation Success	Anomaly	NULL	Windows Event Log AppXDeployment-Server 854	T1204.002
Windows AppX Deployment Unsigned Package Installation	TTP	NULL	Windows Event Log AppXDeployment-Server 855	T1204.002
Windows Binary Execution from an Archive	Anomaly	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2	T1204.002
Windows Default Cobalt Strike PowerShell Beacon	TTP	NULL	Powershell Script Block Logging 4104	T1204.002
Windows Developer-Signed MSIX Package Installation	Anomaly	NULL	Windows Event Log AppXDeployment-Server 855	T1204.002
Windows EFI Volume Mount Attempt Via Mountvol	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1204.002
Windows Explorer LNK Exploit Process Launch With Padding	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688	T1204.002
Windows Explorer.exe Spawning PowerShell or Cmd	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688	T1204.002
Windows ISO LNK File Creation	Hunting	NULL	Sysmon EventID 11	T1204.001
Windows MSIX Package Interaction	Hunting	NULL	Windows Event Log AppXPackaging 171	T1204.002
Windows Mustang Panda USB Tool Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1204.002
Windows NorthStar C2 Agent Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1204.002
Windows PowerShell FakeCAPTCHA Clipboard Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data	T1204.001
Windows PowerShell Script From WindowsApps Directory	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1204.002
Windows Suspect Process With Authentication Traffic	Anomaly	NULL	Sysmon EventID 3	T1204.002
Windows Suspicious QEMU Execution	TTP	NULL	Sysmon EventID 1	T1204.002
Windows Universal Data Link File Creation	Anomaly	NULL	Sysmon EventID 11	T1204.002
Windows User Execution Malicious URL Shortcut File	Anomaly	NULL	Sysmon EventID 11	T1204.002

Sub-techniques5

ID	Name	Examples
T1204.001	Malicious Link	88
T1204.002	Malicious File	196
T1204.003	Malicious Image	1
T1204.004	Malicious Copy and Paste	5
T1204.005	Malicious Library	1

Groups2

LAPSUS$Scattered Spider

Software2

Lumma Stealer Raspberry Robin

Campaigns1

Water Curupira Pikabot Distribution

Procedure examples5

Groups2

Used by	Procedure example
GroupLAPSUS$	LAPSUS$ has recruited target organization employees or contractors who provide credentials and approve an associated MFA prompt, or install remote management software onto a corporate workstation, allowing LAPSUS$ to take control of an authenticated system. MSTIC DEV-0537 Mar 2022
GroupScattered Spider	Scattered Spider has impersonated organization IT and helpdesk staff to instruct victims to execute commercial remote access tools to gain initial access. CISA Scattered Spider Advisory November 2023

Software2

Used by	Procedure example
MalwareLumma Stealer	Lumma Stealer has been distributed through a fake CAPTCHA that presents instructions to the victim to open Windows Run window (“Windows Button + R”) and paste clipboard contents (“CTRL + V”) and press “Enter” to execute a Base64-encoded PowerShell. Cybereason LumaStealer Undated Netskope LummaStealer 2025 Qualys LummaStealer 2024
MalwareRaspberry Robin	Raspberry Robin execution can rely on users directly interacting with malicious LNK files. Microsoft RaspberryRobin 2022

Campaigns1

Used by	Procedure example
CampaignWater Curupira Pikabot Distribution	Water Curupira Pikabot Distribution requires users to interact with malicious attachments in order to start Pikabot installation. TrendMicro Pikabot 2024

References5

Krebs Discord Bookmarks 2023 Open source
Brian Krebs. (2023, May 30). Discord Admins Hacked by Malicious Bookmarks. Retrieved January 2, 2024.
Reliaquest-execution Open source
Reliaquest. (2024, May 31). New Execution Technique in ClearFake Campaign. Retrieved August 2, 2024.
Talos Roblox Scam 2023 Open source
Tiago Pereira. (2023, November 2). Attackers use JavaScript URLs, API forms and more to scam users in popular online game “Roblox”. Retrieved January 2, 2024.
Telephone Attack Delivery Open source
Selena Larson, Sam Scholten, Timothy Kromphardt. (2021, November 4). Caught Beneath the Landline: A 411 on Telephone Oriented Attack Delivery. Retrieved January 5, 2022.
proofpoint-selfpwn Open source
Tommy Madjar, Dusty Miller, Selena Larson. (2024, June 17). From Clipboard to Compromise: A PowerShell Self-Pwn. Retrieved August 2, 2024.