Contagious InterviewG1052 ↗
Has lured victims to click on a malicious link that led to download of a malicious payload.1 Contagious Interview has also leveraged links to malicious payloads on social media and code repositories.1
- Tactic
- Execution
- Platforms
- Linux, macOS, Windows
- Version
- 1.2
- Created
- 11 March 2020
- Last modified
- 12 May 2026
An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution. Links may also lead users to download files that require execution via Malicious File.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
49
Threat groupsTop 2%
Threat groups98th percentile · 98% of ATT&CK techniques have this many threat groups attributed or fewer.9
CampaignsTop 4%
Campaigns96th percentile · 96% of ATT&CK techniques have this many campaigns recorded or fewer.30
Tools & malwareTop 12%
Tools & malware88th percentile · 88% of ATT&CK techniques have this many tools implementing them or fewer.6
Detection rules67th pct
Detection rules67th percentile · 67% of ATT&CK techniques have this many detection rules written or fewer.Malicious Link MITRE reference T1204.001
Top 2%of all ATT&CK techniques for number of groups
49 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
RedCurlG1039 ↗
TA578G1038 ↗
Has placed malicious links in contact forms on victim sites, often spoofing a copyright complaint, to redirect users to malicious file downloads.1
TA577G1037 ↗
Has lured users into executing malicious JavaScript files by sending malicious links via email.1
Winter VivernG1035 ↗
Has mimicked legitimate government-related domains to deliver malicious webpages containing links to documents or other content for user execution.12
DaggerflyG1034 ↗
Has used strategic website compromise to deliver a malicious link requiring user interaction.1
All 49 groups for this technique · 6 newest in this preview
9 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
RedDelta Modified PlugX Infection Chain OperationsC0047 ↗
Mustang Panda distributed hyperlinks that would result in an MSC file running a PowerShell command to download and install a remotely-hosted MSI file during RedDelta Modified PlugX Infection Chain Operations.1
Water Curupira Pikabot DistributionC0037 ↗
Distributed a PDF attachment containing a malicious link to a Pikabot installer.1
C0011C0011 ↗
During C0011, Transparent Tribe relied on student targets to click on a malicious link sent via email.1
Operation SpalaxC0005 ↗
During Operation Spalax, the threat actors relied on a victim to click on a malicious link distributed via phishing emails.1
Operation Dream JobC0022 ↗
During Operation Dream Job, Lazarus Group lured users into executing a malicious link to disclose private account information or provide initial access.12
C0021C0021 ↗
During C0021, the threat actors lured users into clicking a malicious link which led to the download of a ZIP archive containing a malicious .LNK file.1
All 9 campaigns for this technique · 6 newest in this preview
30 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Kali365S9044 ↗
Has directed victims to actor-controlled phishing pages through malicious links, initiating device code authorization flows or adversary-in-the-middle session capture. 12
ROAMINGHOUSES9026 ↗
Has been executed through luring victims into clicking links to download malicious ZIP files.1
QilinS1242 ↗
Has been executed by luring victims into clicking links in spearphishing emails.12
LatrodectusS1160 ↗
Has been executed through malicious links distributed in email campaigns.12
GootloaderS1138 ↗
Has been executed through malicious links presented to users as internet search results.12
SocGholishS1124 ↗
Has lured victims into interacting with malicious links on compromised websites for execution.1
All 30 software entries for this technique · 6 newest in this preview
Offense vs defense T1204.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 7Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 2
first rule: 2019 Q2 · 7 of 9 campaigns plotted (Night Dragon (dated 2009), Operation AkaiRyū (dated 2004) fall before the 2016 window)Malicious Link detection strategy DET0066
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
User Execution – Malicious Link (click → suspicious egress → download/write → follow-on activity)
3 platforms
AN0178 · Windows
Behavioral chain: (1) a user-facing app (browser/Office/email client) launches a URL or handles a link, then (2) the same process lineage makes an outbound connection to an untrusted domain/IP, (3) a file is downloaded or unpacked to a user-writable location shortly after the click. Optional enrichment: subsequent child execution by LOLBINs.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
| Network Traffic ContentDC0085 | NSM:Flow | Suspicious URL patterns, uncommon TLDs, short-lived domains, URL shorteners; HTTP method GET/POST |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Correlation window (e.g., 15m) between link click / first egress / file write. |
| BrowserParents | Processes considered link sources: chrome.exe, msedge.exe, firefox.exe, winword.exe, outlook.exe, teams.exe. |
| UserPaths | User-writable directories to monitor (%USERPROFILE%\Downloads, %TEMP%, %APPDATA%\*, OneDrive caches). |
| SuspiciousTLDs | High-risk TLD and domain list (e.g., .top .xyz .monster; newly observed domains/NOD). |
| AllowedCDNs | Corporate CDNs/update hosts to reduce false positives. |
AN0179 · Linux
Behavioral chain: (1) browser/office/GUI mail client opens a URL, (2) outbound connection to untrusted domain, (3) a new file is saved in $HOME/Downloads, /tmp, or cache immediately after.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File CreationDC0039 | auditd:SYSCALL | open,creat,rename: Writes in $HOME/Downloads, /tmp, ~/.cache with exe/script/archive/office extensions |
| Network Connection CreationDC0082 | auditd:SYSCALL | execve: Execs of chromium, google-chrome, firefox, libreoffice with http(s) in cmdline |
| Network Traffic ContentDC0085 | NSM:Flow | Suspicious URL patterns, uncommon TLDs, URL shorteners |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Typical 10–20m between click and write. |
| UserPaths | $HOME/Downloads, /tmp, ~/.cache, ~/.local/share. |
| HighRiskExtensions | exe, elf, sh, js, py, jar, iso, img, zip, rar, xlsm, docm, xll. |
| DomainRiskScore | Heuristic or TI score threshold for domains. |
AN0180 · macOS
Behavioral chain: (1) Safari/Chrome/Firefox/Office handles a URL; unified logs show open/click or LSQuarantine assignment, (2) outbound connection to untrusted domain, (3) a new file appears in ~/Downloads or /private/var/folders/* with quarantine flag.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File CreationDC0039 | fs:fsevents | Create in /Users/*/Downloads or /private/var/folders/* with quarantine attribute |
| Network Connection CreationDC0082 | NSM:Connections | New outbound connection from Safari/Chrome/Firefox/Word |
| Network Traffic ContentDC0085 | macos:unifiedlog | open URL|clicked link|LSQuarantineAttach |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | 10–30m correlation. |
| QuarantinePolicy | Alert when com.apple.quarantine missing on newly downloaded executables. |
| SuspiciousTLDs | Org-specific risky domains/TLDs. |
If a link is being visited by a user, network intrusion prevention systems and systems designed to scan and remove malicious downloads can be used to block activity.
If a link is being visited by a user, block unknown or unused files in transit by default that should not be downloaded or by policy from suspicious sites as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl, etc. Some download scanning devices can open and analyze compressed and encrypted formats, such as zip and rar that may be used to conceal malicious files.
User TrainingM1017
Use user training as a way to bring awareness to common phishing and spearphishing techniques and how to raise suspicion for potentially malicious events.