MITRE ATT&CKsub-technique

T1204.002 Malicious File

Published 2020-03-11 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Execution
Platforms
Linux, macOS, Windows
Version
1.6
Created
2020-03-11

Description

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso. Adversaries may employ various forms of Masquerading and Obfuscated Files or Information to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it. While Malicious File frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1204 User Execution technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (3)

  • M1038 Execution Prevention mitigation
  • M1040 Behavior Prevention on Endpoint mitigation
  • M1017 User Training mitigation

Referenced by MITRE ATT&CK · uses (197)

  • G1059 NIMBUS MANTICORE group
  • S9035 LAMEHUG software (malware)
  • S9037 RustyWater software (malware)
  • G1055 VOID MANTICORE group
  • S9031 AshTag software (malware)
  • C0060 Operation AkaiRyū campaign
  • G1054 MirrorFace group
  • S9020 LODEINFO software (malware)
  • S9026 ROAMINGHOUSE software (malware)
  • G1052 Contagious Interview group
  • S1246 BeaverTail software (malware)
  • S1242 Qilin software (malware)
  • S1240 RedLine Stealer software (malware)
  • S1236 CLAIMLOADER software (malware)
  • S1238 STATICPLUGIN software (malware)
  • S1230 HIUPAN software (malware)
  • S1229 Havoc software (malware)
  • S1213 Lumma Stealer software (malware)
  • G1046 Storm-1811 group
  • C0047 RedDelta Modified PlugX Infection Chain Operations campaign
  • S1183 StrelaStealer software (malware)
  • S1169 Mango software (malware)
  • G1039 RedCurl group
  • S1160 Latrodectus software (malware)
  • G1036 Moonstone Sleet group
  • C0037 Water Curupira Pikabot Distribution campaign
  • S1142 LunarMail software (malware)
  • G1033 Star Blizzard group
  • G1031 Saint Bear group
  • G1026 Malteiro group
Show all 197 ›

Referenced by Compliance · mitigates (19)

  • CIS-10.1 Deploy and Maintain Anti-Malware Software CIS Safeguard v8.1
  • CIS-10.4 Configure Automatic Anti-Malware Scanning of Removable Media CIS Safeguard v8.1
  • CIS-10.7 Use Behavior-Based Anti-Malware Software CIS Safeguard v8.1
  • CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-2.5 Allowlist Authorized Software CIS Safeguard v8.1
  • CIS-9.6 Block Unnecessary File Types CIS Safeguard v8.1
  • CIS-9.7 Deploy and Maintain Email Server Anti-Malware Protections CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SC-44 Detonation Chambers NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control
  • NIST-SI-8 Spam Protection NIST 800-53 control

References