ShinyHuntersG1057 ↗
Has exploited vulnerabilities in the target company’s GitHub repository source code to enable more complex follow-on third-party or supply chain attacks.1
tfMITRE ATT&CK technique
Exploitation for Client Execution T1203
- Tactic
- Execution
- Platforms
- Linux, macOS, Windows
- Version
- 1.5
- Created
- 18 April 2018
- Last modified
- 24 October 2025
Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
42
Threat groupsTop 3%
Threat groups97th percentile · 97% of ATT&CK techniques have this many threat groups attributed or fewer.5
CampaignsTop 9%
Campaigns91st percentile · 91% of ATT&CK techniques have this many campaigns recorded or fewer.14
Tools & malwareTop 22%
Tools & malware78th percentile · 78% of ATT&CK techniques have this many tools implementing them or fewer.48
Detection rulesTop 5%
Detection rules95th percentile · 95% of ATT&CK techniques have this many detection rules written or fewer.Exploitation for Client Execution MITRE reference T1203
Top 3%of all ATT&CK techniques for number of groups
42 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
UNC3886G1048 ↗
Has exoloited CVE-2023-34048 to enable command execution on vCenter servers and CVE-2023-20867 in VMware Tools to execute unauthenticated Guest Operations from ESXi hosts to guest VMs.1
Sea TurtleG1041 ↗
Has used exploits for vulnerabilities such as CVE-2021-44228, CVE-2021-21974, and CVE-2022-0847 to achieve client code execution.1
Saint BearG1031 ↗
Has leveraged vulnerabilities in client applications such as CVE-2017-11882 in Microsoft Office to enable code execution in victim environments.1
EXOTIC LILYG1011 ↗
Has used malicious documents containing exploits for CVE-2021-40444 affecting Microsoft MSHTML.1
Aoqin DragonG1007 ↗
Has exploited CVE-2012-0158 and CVE-2010-3333 for execution against targeted systems.1
All 42 groups for this technique · 6 newest in this preview
5 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
RedPenguinC0056 ↗
During RedPenguin, UNC3886 exploited CVE-2025-21590 to bypass Veriexec protections in Junos OS designed to prevent unauthorized binary execution.12
RedDelta Modified PlugX Infection Chain OperationsC0047 ↗
Mustang Panda used the GrimResource exploitation technique via specially crafted MSC files for arbitrary code execution during RedDelta Modified PlugX Infection Chain Operations.1
3CX Supply Chain AttackC0057 ↗
During the 3CX Supply Chain Attack, AppleJeus leveraged the Chrome vulnerability, CVE-2022-0609, in combination with a Drive-by Compromise website.1
FrankensteinC0001 ↗
During Frankenstein, the threat actors exploited CVE-2017-11882 to execute code on the victim's machine.1
Operation Dust StormC0016 ↗
During Operation Dust Storm, the threat actors exploited Adobe Flash vulnerability CVE-2011-0611, Microsoft Windows Help vulnerability CVE-2010-1885, and several Internet Explorer vulnerabilities, including CVE-2011-1255, CVE-2012-1889, and CVE-2014-0322.1
All 5 campaigns for this technique
14 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
XLoaderS1207 ↗
Has exploited Office vulnerabilities during local execution such as CVE-2017-11882 and CVE-2018-0798.1
VersaMemS1154 ↗
Was installed through exploitation of CVE-2024-39717 in Versa Director servers.1
Woody RATS1065 ↗
Has relied on CVE-2022-30190 (Follina) for execution during delivery.1
SUPERNOVAS0578 ↗
Was installed via exploitation of a SolarWinds Orion API authentication bypass vulnerability (CVE-2020-10148).12
RamsayS0458 ↗
Has been embedded in documents exploiting CVE-2017-0199, CVE-2017-11882, and CVE-2017-8570.12
EvilBunnyS0396 ↗
Has exploited CVE-2011-4369, a vulnerability in the PRC component in Adobe Reader.1
All 14 software entries for this technique · 6 newest in this preview
Offense vs defense T1203
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 5Sigma rules (cumulative) · 36Splunk ESCU (cumulative) · 12
first rule: 2017 Q1 · 5 of 5 campaigns plottedExploitation for Client Execution detection strategy DET0287
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Exploitation for Client Execution – cross-platform behavior chain (browser/Office/3rd-party apps)
3 platforms
AN0797 · Windows
Cause→effect chain: (1) A client app (browser, Office, PDF/Flash/reader) experiences a crash/abnormal exit or loads from an unusual location, then (2) drops or modifies a file in user-writable paths, and/or (3) spawns an unexpected child (e.g., powershell/cmd/mshta/rundll32/wscript/installer), and (4) establishes outbound C2-like connections shortly after. Correlate application logs, file writes, process lineage, and network egress within a short window.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Application Log ContentDC0038 | WinEventLog:Application | EventCode=1000 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Correlation window (e.g., 15m) between crash/write/child/network. |
| HighRiskChildren | List of child processes that should rarely spawn from Office/browsers (powershell.exe, cmd.exe, wscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, msiexec.exe, curl.exe). |
| UserPaths | Writable paths to watch (Downloads, %TEMP%, %APPDATA%, OneDrive, Office startup folders). |
| AllowedPlugins | Known add-ins/extensions and updater binaries to reduce noise. |
| EgressAllowlist | Known update/CDN domains and proxy egress CIDRs for suppression. |
AN0798 · Linux
Cause→effect chain: (1) Browser/Office/reader process logs crash/segfault or abnormal sandbox message, (2) new executable/script/write occurs in $HOME (Downloads, ~/.cache, /tmp), (3) unexpected child like curl/wget/bash/python opens network connections soon after.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| Application Log ContentDC0038 | linux:syslog | browser/office crash, segfault, abnormal termination |
| File CreationDC0039 | auditd:SYSCALL | creat |
| File AccessDC0055 | auditd:SYSCALL | open |
| File ModificationDC0061 | auditd:SYSCALL | rename,chmod |
| Network Traffic FlowDC0078 | NetFlow:Flow | new outbound connections from exploited process tree |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | 5–20m correlation window. |
| UserPaths | HOME write targets: ~/Downloads, ~/.config/autostart, ~/.local/share, /tmp. |
| HighRiskChildren | bash, sh, python, perl, node, curl, wget, socat, openssl, xxd. |
| PackageUpdaters | Allow-list common updaters (snap, flatpak, packagekit) to reduce FP. |
AN0799 · macOS
Cause→effect chain: (1) App crash/abnormal termination in unified logs for Safari/Chrome/Office/Preview, (2) new files/scripts in ~/Library, ~/Downloads, /private/var/folders/*, (3) unexpected child (osascript, zsh, bash, curl) spawned by those apps, (4) new outbound connections.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:osquery | exec |
| Application Log ContentDC0038 | macos:unifiedlog | process crash, abort, code signing violations |
| File ModificationDC0061 | fs:fsevents | create/write/rename under user-writable paths |
| Network Traffic FlowDC0078 | NSM:Connections | new connections from exploited lineage |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | 10–30m correlation window. |
| HighRiskChildren | osascript, bash, zsh, curl, python, pbpaste/pbcopy, open -a Terminal. |
| UserPaths | ~/Library/LaunchAgents, ~/Library/Containers/*/Data, /private/var/folders/*. |
| QuarantineBypass | Flag files with missing com.apple.quarantine extended attribute when sourced from internet. |
Browser sandboxes can be used to mitigate some of the impact of exploitation, but sandbox escapes may still exist. Other types of virtualization and application microsegmentation may also mitigate the impact of client-side exploitation. Risks of additional exploits and weaknesses in those systems may still exist.
Exploit ProtectionM1050
Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. Many of these protections depend on the architecture and target application binary for compatibility.
Update SoftwareM1051
Perform regular software updates to mitigate exploitation risk. Keeping software up-to-date with the latest security patches helps prevent adversaries from exploiting known vulnerabilities in client software, reducing the risk of successful attacks.