Scattered SpiderG1015 ↗
Has impersonated organization IT and helpdesk staff to instruct victims to execute commercial remote access tools to gain initial access.1
tfMITRE ATT&CK technique
User Execution T1204
- Tactic
- Execution
- Platforms
- Linux, Windows, macOS, IaaS, Containers
- Version
- 1.8
- Created
- 18 April 2018
- Last modified
- 24 October 2025
- Contributors
- Oleg Skulkin, Group-IB; Menachem Goldstein; Harikrishnan Muthu, Cyble; ReliaQuest; Ale Houspanossian; Fernando Bacchin
Sub-techniques 5123 rules across the family · 37 mapped directly to T1204 · 4 of 5 carry rules
An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
2
Threat groups56th pct
Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.2
Tools & malware51st pct
Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.37
Detection rulesTop 6%
Detection rules94th percentile · 94% of ATT&CK techniques have this many detection rules written or fewer.User Execution MITRE reference T1204
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
LAPSUS$G1004 ↗
Has recruited target organization employees or contractors who provide credentials and approve an associated MFA prompt, or install remote management software onto a corporate workstation, allowing LAPSUS$ to take control of an authenticated system.1
All 2 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Water Curupira Pikabot DistributionC0037 ↗
Requires users to interact with malicious attachments in order to start Pikabot installation.1
All 1 campaigns for this technique
2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Lumma StealerS1213 ↗
Has been distributed through a fake CAPTCHA that presents instructions to the victim to open Windows Run window (“Windows Button + R”) and paste clipboard contents (“CTRL + V”) and press “Enter” to execute a Base64-encoded PowerShell.123
Raspberry RobinS1130 ↗
Execution can rely on users directly interacting with malicious LNK files.1
All 2 software entries for this technique
Offense vs defense T1204
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 10Splunk ESCU (cumulative) · 27
first rule: 2020 Q1 · 1 of 1 campaigns plottedUser Execution detection strategy DET0478
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
User Execution – multi-surface behavior chain (documents/links → helper/unpacker → LOLBIN/child → egress)
5 platforms
AN1314 · Windows
Cause→effect chain: (1) User-facing app (Office/PDF/archiver/browser) records an open/click or abnormal event, then (2) a downloaded file is created in a user-writable path and/or decompressed, (3) the parent user app spawns a living-off-the-land binary (e.g., powershell/cmd/mshta/rundll32/msiexec/wscript/expand/zip) or installer, and (4) immediate outbound HTTP(S)/DNS/SMB from the same lineage.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| Application Log ContentDC0038 | WinEventLog:Application | EventCode=1000 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Correlation window (e.g., 15 minutes) from document open to child/egress. |
| HighRiskParents | Apps that should rarely spawn OS utilities (winword.exe, excel.exe, powerpnt.exe, acrord32.exe, chrome/msedge/firefox, 7zFM.exe, winrar.exe, explorer.exe). |
| HighRiskChildren | LOLBIN list: powershell.exe, cmd.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, msiexec.exe, curl.exe, bitsadmin.exe, pcalua.exe, expand.exe, tar.exe. |
| UserPaths | Writable paths to watch: %USERPROFILE%\Downloads, %TEMP%, %APPDATA%\*, OneDrive/Teams cache, Office startup folders. |
| EgressAllowList | Corporate update/CDN domains and proxy egress CIDRs to suppress benign updater traffic. |
AN1315 · Linux
Cause→effect chain: (1) User app/browser/archiver logs an open/click or abnormal exit, (2) new executable/script/archive extracted into $HOME/Downloads, /tmp, or ~/.cache, (3) parent app spawns shell/interpreter (bash/sh/python/node/curl/wget) or desktop file, and (4) new outbound connection(s) from the child lineage.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| Application Log ContentDC0038 | linux:syslog | opened document|clicked link|segfault|abnormal termination|sandbox |
| File CreationDC0039 | auditd:SYSCALL | creat |
| File AccessDC0055 | auditd:SYSCALL | open |
| File ModificationDC0061 | auditd:SYSCALL | rename,chmod |
| Network Connection CreationDC0082 | NSM:Flow | new outbound connection from browser/office lineage |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | 5–20 minute correlation window. |
| UserPaths | $HOME/Downloads, /tmp, ~/.cache, ~/.config/autostart, ~/.local/share. |
| HighRiskChildren | bash, sh, zsh, python*, perl, node, curl, wget, xdg-open, kde-open, gio open, unzip/tar extraction leading to exec. |
| PkgUpdaters | Allow-list snap/flatpak/packagekit/apt workers to reduce false positives. |
AN1316 · macOS
Cause→effect chain: (1) unified logs show application open/click or crash for Safari/Chrome/Office/Preview/archiver, (2) file write/extraction into ~/Downloads, /private/var/folders/* or ~/Library, (3) parent app spawns osascript/bash/zsh/curl/python or opens a quarantined app with Gatekeeper prompts, (4) network egress from child.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:osquery | exec |
| Application Log ContentDC0038 | macos:unifiedlog | opened document|clicked link|EXC_BAD_ACCESS|abort|LSQuarantine |
| File CreationDC0039 | fs:fileevents | create/write/rename in user-writable paths |
| Network Connection CreationDC0082 | NSM:Flow | new outbound connection from exploited lineage |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | 10–30 minute correlation window. |
| HighRiskChildren | osascript, bash, zsh, curl, python, open -a Terminal, installer, tccutil misuse. |
| QuarantineSignals | Flag new apps lacking com.apple.quarantine or with quarantine='0081' (downloaded then auto-opened). |
AN1317 · Containers
Cause→effect chain in CI/dev desktops: (1) user triggers container run/pull after opening a doc/link/script, (2) newly created image/container uses unexpected external registry or entrypoint, (3) container starts and immediately egresses to suspicious destinations.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Container CreationDC0072 | docker:events | created,started: new container from untrusted registry or unexpected entrypoint |
| Container StartDC0077 | docker:events | start |
| Network Traffic ContentDC0085 | NSM:Flow | container egress to unknown IPs/domains |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TrustedRegistries | Approved registries/namespaces. |
| AllowedEntrypoints | Expected CMD/ENTRYPOINT for known images. |
| TimeWindow | Correlate user action → docker/podman run within 10 minutes. |
AN1318 · IaaS
Cause→effect chain in cloud consoles: (1) user clicks link then invokes instance/image creation via API, (2) instance/image originates from external AMI or unknown image, (3) instance immediately egresses or retrieves payloads.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Instance CreationDC0076 | AWS:CloudTrail | RunInstances,CreateImage |
| Instance StartDC0080 | AWS:CloudTrail | StartInstances |
| Network Traffic ContentDC0085 | gcp:vpcflow | first 5m egress to unknown ASNs |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ApprovedImages | AMI/image allow-list with owners. |
| UserContext | High-risk identities (federated, external IdP). |
| TimeWindow | 5–30 minutes from console/API action to network egress. |
On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent executable files from running unless they meet a prevalence, age, or trusted list criteria and to prevent Office applications from creating potentially malicious executable content by blocking malicious code from being written to disk. Note: cloud-delivered protection must be enabled to use certain rules.
Execution PreventionM1038
Application control may be able to prevent the running of executables masquerading as other files.
Where possible, consider requiring developers to pull from internal repositories containing verified and approved packages rather than from external ones.
If a link is being visited by a user, network intrusion prevention systems and systems designed to scan and remove malicious downloads can be used to block activity.
If a link is being visited by a user, block unknown or unused files in transit by default that should not be downloaded or by policy from suspicious sites as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl, etc. Some download scanning devices can open and analyze compressed and encrypted formats, such as zip and rar that may be used to conceal malicious files.
User TrainingM1017
Use user training as a way to bring awareness to common phishing and spearphishing techniques and how to raise suspicion for potentially malicious events.