t1204-002-malicious-file

name	T1204.002_malicious-file
description	An adversary may rely upon a user opening a malicious file in order to gain execution.
category	input-validation
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1204.002","execution","linux","macos","windows","sub-technique"]
technique_id	T1204.002
tactic	execution
all_tactics	["execution"]
platforms	["Linux","macOS","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1204/002
tech_stack	["linux","macos","windows"]
cwe_ids	["CWE-94"]
chains_with	["T1204","T1204.001","T1204.003","T1204.004","T1204.005"]
prerequisites	["T1204"]
severity_boost	{"T1204":"Chain with T1204 for deeper attack path","T1204.001":"Chain with T1204.001 for deeper attack path","T1204.003":"Chain with T1204.003 for deeper attack path"}

T1204.002 Malicious File

Sub-technique of: T1204

High-Level Description

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.

Adversaries may employ various forms of Masquerading and Obfuscated Files or Information to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.

While Malicious File frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.

Kill Chain Phase

• Execution (TA0002)

Platforms: Linux, macOS, Windows

What to Check

• Identify if Malicious File technique is applicable to target environment
• Check Linux systems for indicators of Malicious File
• Check macOS systems for indicators of Malicious File
• Check Windows systems for indicators of Malicious File
• Verify mitigations are bypassed or absent (3 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: OSTap Style Macro Execution

This Test uses a VBA macro to create and execute #{jse_path} with cscript.exe. Upon execution, the .jse file launches wscript.exe. Execution is handled by Invoke-MalDoc to load and execute VBA code into Excel or Word documents. This is a known execution chain observed by the OSTap downloader commonly used in TrickBot campaigns. References: