MITRE ATT&CKtactic
TA0002 Execution
- Domain
- enterprise
- Version
- 1.1
- Created
- 2018-10-17
Description
The adversary is trying to run malicious code or instructions on a system.
Execution consists of techniques that result in adversary-controlled code running on a local or remote system. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data. For example, an adversary might use a remote access tool to run a PowerShell script that does Remote System Discovery.
Related
Referenced by MITRE ATT&CK · tactic (66)
- T1698 Indirect Prompt Injection technique
- T1699 Direct Prompt Injection technique
- T1059.013 Container CLI/API sub-technique
- T1204.005 Malicious Library sub-technique
- T1677 Poisoned Pipeline Execution technique
- T1675 ESXi Administration Command technique
- T1674 Input Injection technique
- T1059.012 Hypervisor CLI sub-technique
- T1127.003 JamPlus sub-technique
- T1204.004 Malicious Copy and Paste sub-technique
- T1569.003 Systemctl sub-technique
- T1127.002 ClickOnce sub-technique
- T1059.011 Lua sub-technique
- T1059.010 AutoHotKey & AutoIT sub-technique
- T1574.014 AppDomainManager sub-technique
- T1651 Cloud Administration Command technique
- T1648 Serverless Execution technique
- T1059.009 Cloud API sub-technique
- T1574.013 KernelCallbackTable sub-technique
- T1559.003 XPC Services sub-technique
- T1204.003 Malicious Image sub-technique
- T1053.007 Container Orchestration Job sub-technique
- T1609 Container Administration Command technique
- T1610 Deploy Container technique
- T1059.008 Network Device CLI sub-technique
- T1053.006 Systemd Timers sub-technique
- T1574.012 COR_PROFILER sub-technique
- T1059.007 JavaScript sub-technique
- T1127.001 MSBuild sub-technique
- T1574.004 Dylib Hijacking sub-technique