CmdID

CmdID / Techniques

T1204 User Execution

An adversary may rely upon specific actions by a user in order to gain execution. MITRE ATT&CK

6 Sigma rules T1204 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK
T1204.001User Execution: Malicious Link
T1204.002User Execution: Malicious File
T1204.004User Execution: Malicious Copy and Paste

Sigma rules tagged with it

process creation, the highest levels first
criticalDarkSide Ransomware PatternFlorian Roth (Nextron Systems) · Windows
highPotential Snatch Ransomware ActivityFlorian Roth (Nextron Systems) · Windows
mediumArbitrary Shell Command Execution Via Settingcontent-MsSreeman · Windows
mediumPayload Decoded and Decrypted via Built-in UtilitiesTim Rauch (rule), Elastic (idea) · macOS
mediumPotentially Suspicious WebDAV LNK ExecutionMicah Babinski · Windows
mediumSuspicious Execution via macOS Script EditorTim Rauch (rule), Elastic (idea) · macOS