CmdID / Techniques / T1204

T1204.002 User Execution: Malicious File

An adversary may rely upon a user opening a malicious file in order to gain execution. MITRE ATT&CK

2 programs on CmdID 15 Sigma rules T1204.002 on attack.mitre.org

Part of

MITRE ATT&CK

T1204User Execution

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

mmc.exeits Sigma rules wmic.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first

criticalExploit for CVE-2017-8759Florian Roth (Nextron Systems) · Windows

criticalPotential Maze Ransomware ActivityFlorian Roth (Nextron Systems) · Windows

highMMC Executing Files with Reversed Extensions Using RTLO AbuseSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

highSuspicious Binary In User Directory Spawned From Office ApplicationJason Lynch · Windows

highSuspicious LNK Command-Line Padding with Whitespace CharactersSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io · Windows

highSuspicious Microsoft Office Child Process - MacOSSohan G (D4rkCiph3r) · macOS

highSuspicious Outlook Child ProcessMichael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team · Windows

highSuspicious WMIC Execution Via Office ProcessVadim Khrykov, Cyb3rEng · Windows

highSuspicious WmiPrvSE Child ProcessVadim Khrykov (ThreatIntel), Cyb3rEng, Florian Roth (Nextron Systems) · Windows

highTanStack Supply-Chain Attack Execution Indicators - LinuxLeonardo Gasparini · Linux

highTanStack Supply-Chain Attack Execution Indicators - WindowsLeonardo Gasparini · Windows

mediumExploit for CVE-2017-0261Florian Roth (Nextron Systems) · Windows

mediumPotential Suspicious Browser Launch From Document Reader ProcessJoseph Kamau · Windows

lowWindows MSIX Package Support Framework AI_STUBS ExecutionMichael Haag, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows