MITRE ATT&CKsub-technique

T1204.001 Malicious Link

Published 2020-03-11 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Execution
Platforms
Linux, macOS, Windows
Version
1.2
Created
2020-03-11

Description

An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution. Links may also lead users to download files that require execution via Malicious File.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1204 User Execution technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (3)

  • M1031 Network Intrusion Prevention mitigation
  • M1017 User Training mitigation
  • M1021 Restrict Web-Based Content mitigation

Referenced by MITRE ATT&CK · uses (90)

  • G1059 NIMBUS MANTICORE group
  • S9050 Vidar software (malware)
  • S9044 Kali365 software (malware)
  • C0060 Operation AkaiRyū campaign
  • S9026 ROAMINGHOUSE software (malware)
  • G1052 Contagious Interview group
  • S1242 Qilin software (malware)
  • C0047 RedDelta Modified PlugX Infection Chain Operations campaign
  • G1039 RedCurl group
  • G1037 TA577 group
  • G1038 TA578 group
  • S1160 Latrodectus software (malware)
  • G1035 Winter Vivern group
  • G1034 Daggerfly group
  • C0037 Water Curupira Pikabot Distribution campaign
  • S1138 Gootloader software (malware)
  • G1031 Saint Bear group
  • S1124 SocGholish software (malware)
  • G1020 Mustard Tempest group
  • S1086 Snip3 software (malware)
  • G1018 TA2541 group
  • C0022 Operation Dream Job campaign
  • C0021 C0021 campaign
  • G1014 LuminousMoth group
  • C0016 Operation Dust Storm campaign
  • C0011 C0011 campaign
  • C0005 Operation Spalax campaign
  • C0002 Night Dragon campaign
  • S1039 Bumblebee software (malware)
  • G1011 EXOTIC LILY group
Show all 90 ›

Referenced by Compliance · mitigates (15)

  • CIS-13.10 Perform Application Layer Filtering CIS Safeguard v8.1
  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-9.2 Use DNS Filtering Services CIS Safeguard v8.1
  • CIS-9.3 Maintain and Enforce Network-Based URL Filters CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SC-44 Detonation Chambers NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-8 Spam Protection NIST 800-53 control