t1204-user-execution

name	T1204_user-execution
description	An adversary may rely upon specific actions by a user in order to gain execution.
category	input-validation
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1204","execution","linux","windows","macos","iaas","containers"]
technique_id	T1204
tactic	execution
all_tactics	["execution"]
platforms	["Linux","Windows","macOS","IaaS","Containers"]
mitre_url	https://attack.mitre.org/techniques/T1204
tech_stack	["linux","windows","macos","cloud","containers"]
cwe_ids	["CWE-94"]
chains_with	["T1204.001","T1204.002","T1204.003","T1204.004","T1204.005"]
prerequisites	[]
severity_boost	{"T1204.001":"Chain with T1204.001 for deeper attack path","T1204.002":"Chain with T1204.002 for deeper attack path","T1204.003":"Chain with T1204.003 for deeper attack path"}

T1204 User Execution

High-Level Description

An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing.

While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.

Adversaries may also deceive users into performing actions such as:

• Enabling Remote Access Tools, allowing direct control of the system to the adversary
• Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies
• Downloading and executing malware for User Execution
• Coerceing users to copy, paste, and execute malicious code manually

For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.

Kill Chain Phase

• Execution (TA0002)

Platforms: Linux, Windows, macOS, IaaS, Containers

What to Check

• Identify if User Execution technique is applicable to target environment
• Check Linux systems for indicators of User Execution
• Check Windows systems for indicators of User Execution
• Check macOS systems for indicators of User Execution
• Verify mitigations are bypassed or absent (6 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to User Execution by examining the target platforms (Linux, Windows, macOS).

2. Assess Existing Defenses: Review whether mitigations for T1204 are in place. If defenses are absent or misconfigured, this technique may be exploitable.