Cross-source coverage

T1204 / ATT&CK

User Execution

293 rules · 287 families across 12 sources.

45 deprecated hidden · include 3 atomic-IOC hidden · include

From MITRE ATT&CK 19.2

An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing.

While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.

Adversaries may also deceive users into performing actions such as:

Enabling Remote Access Tools, allowing direct control of the system to the adversary
Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies
Downloading and executing malware for User Execution
Coerceing users to copy, paste, and execute malicious code manually

For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.

Tactics: Execution
Platforms: Linux · Windows · macOS · IaaS · Containers
Telemetry: WinEventLog:ApplicationWinEventLog:SysmonWinEventLog:Securitylinux:syslogauditd:SYSCALLNSM:Flowmacos:unifiedlogfs:fileeventsmacos:osquerydocker:eventsAWS:CloudTrailgcp:vpcflow

How MITRE says to detect it DET0478

User Execution – multi-surface behavior chain (documents/links → helper/unpacker → LOLBIN/child → egress)

Windows Analytic 1314

Cause→effect chain: (1) User-facing app (Office/PDF/archiver/browser) records an open/click or abnormal event, then (2) a downloaded file is created in a user-writable path and/or decompressed, (3) the parent user app spawns a living-off-the-land binary (e.g., powershell/cmd/mshta/rundll32/msiexec/wscript/expand/zip) or installer, and (4) immediate outbound HTTP(S)/DNS/SMB from the same lineage.

WinEventLog:Application EventCode=1000
WinEventLog:Sysmon EventCode=11
WinEventLog:Security EventCode=4688
WinEventLog:Sysmon EventCode=3, 22

Linux Analytic 1315

Cause→effect chain: (1) User app/browser/archiver logs an open/click or abnormal exit, (2) new executable/script/archive extracted into $HOME/Downloads, /tmp, or ~/.cache, (3) parent app spawns shell/interpreter (bash/sh/python/node/curl/wget) or desktop file, and (4) new outbound connection(s) from the child lineage.

linux:syslog opened document|clicked link|segfault|abnormal termination|sandbox
auditd:SYSCALL open
auditd:SYSCALL creat
auditd:SYSCALL rename,chmod
auditd:SYSCALL execve
NSM:Flow new outbound connection from browser/office lineage

macOS Analytic 1316

Cause→effect chain: (1) unified logs show application open/click or crash for Safari/Chrome/Office/Preview/archiver, (2) file write/extraction into ~/Downloads, /private/var/folders/* or ~/Library, (3) parent app spawns osascript/bash/zsh/curl/python or opens a quarantined app with Gatekeeper prompts, (4) network egress from child.

macos:unifiedlog opened document|clicked link|EXC_BAD_ACCESS|abort|LSQuarantine
fs:fileevents create/write/rename in user-writable paths
macos:osquery exec
NSM:Flow new outbound connection from exploited lineage

Containers Analytic 1317

Cause→effect chain in CI/dev desktops: (1) user triggers container run/pull after opening a doc/link/script, (2) newly created image/container uses unexpected external registry or entrypoint, (3) container starts and immediately egresses to suspicious destinations.

docker:events created,started: new container from untrusted registry or unexpected entrypoint
docker:events start
NSM:Flow container egress to unknown IPs/domains

IaaS Analytic 1318

Cause→effect chain in cloud consoles: (1) user clicks link then invokes instance/image creation via API, (2) instance/image originates from external AMI or unknown image, (3) instance immediately egresses or retrieves payloads.

AWS:CloudTrail RunInstances,CreateImage
AWS:CloudTrail StartInstances
gcp:vpcflow first 5m egress to unknown ASNs

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 293 above — a rule tagged a sub-technique covers this technique too.

splunk/security_content

65 rules

Detection	Severity	Format
ASL AWS ECR Container Upload Outside Business Hours	Undefined	SPL
ASL AWS ECR Container Upload Unknown User	Undefined	SPL
AWS ECR Container Scanning Findings High	Undefined	SPL
AWS ECR Container Scanning Findings Low Informational Unknown	Undefined	SPL
AWS ECR Container Scanning Findings Medium	Undefined	SPL
AWS ECR Container Upload Outside Business Hours	Undefined	SPL
AWS ECR Container Upload Unknown User	Undefined	SPL
AWS Lambda UpdateFunctionCode	Undefined	SPL
Batch File Write to System32	Undefined	SPL
Cisco Isovalent - Non Allowlisted Image Use	Undefined	SPL

+ 55 more from splunk/security_content → showing the 10 highest-severity

elastic/protections-artifacts

56 rules

Detection	Severity	Format
Attempt to Mount a Remote WebDav Share	Undefined	Elastic TOML
Base64 or Xxd Decode Argument Evasion	Undefined	Elastic TOML
Base64 Shebang Payload Decoded via Built-in Utility	Undefined	Elastic TOML
Command Shell Execution from Untrusted Origin	Undefined	Elastic TOML
Decoded or Decrypted Payload Written to Suspicious Directory	Undefined	Elastic TOML
Decoded Payload Piped to Interpreter	Undefined	Elastic TOML
Decoy Document Creation via Curl	Undefined	Elastic TOML
Decoy file Open via Preview App	Undefined	Elastic TOML
Disk Image Download and Mount via Hdiutil	Undefined	Elastic TOML
DLL Loaded from WebDav Share	Undefined	Elastic TOML

+ 46 more from elastic/protections-artifacts → showing the 10 highest-severity

SigmaHQ/sigma

55 rules

Detection	Severity	Format
DarkSide Ransomware Pattern	Critical	Sigma
Droppers Exploiting CVE-2017-11882	Critical	Sigma
Exploit for CVE-2017-8759	Critical	Sigma
Potential Maze Ransomware Activity	Critical	Sigma
PrinterNightmare Mimikatz Driver Name	Critical	Sigma
Antivirus - Hacktool Signature	High	Sigma
FileFix - Command Evidence in TypedPaths	High	Sigma
File With Uncommon Extension Created By An Office Application	High	Sigma
GAC DLL Loaded Via Office Applications	High	Sigma
HackTool - LittleCorporal Generated Maldoc Injection	High	Sigma

+ 45 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/detection-rules

52 rules

Detection	Severity	Format
Base64 Decoded Payload Piped to Interpreter	High	Elastic TOML
Decoded Payload Piped to Interpreter Detected via Defend for Containers	High	Elastic TOML
Elastic Defend Alert Followed by Telemetry Loss	High	Elastic TOML
Execution of File Written or Modified by Microsoft Office	High	Elastic TOML
Gatekeeper Override and Execution	High	Elastic TOML
Google Workspace Object Copied from External Drive with App Consent	High	Elastic TOML
Ingress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers	High	Elastic TOML
Microsoft Build Engine Started by an Office Application	High	Elastic TOML
Potential Execution via FileFix Phishing Attack	High	Elastic TOML
Potential Fake CAPTCHA Phishing Attack	High	Elastic TOML

+ 42 more from elastic/detection-rules → showing the 10 highest-severity

socfortress/Wazuh-Rules

20 rules · 17 families

Detection	Severity	Format
Sysmon - Event 1: Process creation · Encoded PowerShell from Office (T1204.002)	High	Wazuh XML
Sysmon - Event 1: Process creation · Excel launching CMD (T1204.002)	High	Wazuh XML
Sysmon - Event 1: Process creation · Office launching cscript (T1204.002)	High	Wazuh XML
Sysmon - Event 1: Process creation · Office launching explorer (T1204.002)	High	Wazuh XML
Sysmon - Event 1: Process creation · Office launching headless Chrome (T1204.002)	High	Wazuh XML
Sysmon - Event 1: Process creation · Office launching mshta (T1204.002)	High	Wazuh XML
Sysmon - Event 1: Process creation · Office spawning WScript (T1204.002)	High	Wazuh XML
Sysmon - Event 1: Process creation · Suspicious LNK File Execution (T1204.002)	High	Wazuh XML
Sysmon - Event 1: Process creation · win.eventdata.parentImage = winword.exe$\|excel.exe$\|powerpnt.exe 3 variants	High	Wazuh XML
Sysmon - Event 1: Process creation · win.eventdata.parentImage = winword.exe$\|excel.exe$\|powerpnt.exe 3 variants	High	Wazuh XML

+ 10 more from socfortress/Wazuh-Rules → showing the 10 highest-severity

panther-labs/panther-analysis

12 rules

Detection	Severity	Format
Slack Potentially Malicious File Shared	Critical	Panther Python
Gsuite Attachments Downloaded from Spam Email	High	Panther Python
Gsuite Link Clicked in Spam Email	High	Panther Python
Malicious Content Detected	High	Panther Python
Malware Detected in Email	High	Panther Python
Proofpoint Active Threat Campaign Detected	High	Panther Python
Proofpoint Malware Detected	High	Panther Python
Proofpoint Multiple Threats Detected	High	Panther Python
Proofpoint Virus Detected	High	Panther Python
AppOmni Alert Passthrough	Medium	Panther Python

+ 2 more from panther-labs/panther-analysis → showing the 10 highest-severity

Azure/Azure-Sentinel

9 rules

Detection	Severity	Format
Audit policy manipulation using auditpol utility	Medium	KQL
Rare firewall rule changes using netsh	Low	KQL
Discord download invoked from cmd line (ASIM Version)	Undefined	KQL
Email containing malware accessed on a unmanaged device	Undefined	KQL
Gentlemen Ransomware payload execution and staging	Undefined	KQL
LockBit and related tool hash IoCs	Undefined	KQL
Rare Domains in External Teams Messages	Undefined	KQL
RunMRU with non-ASCII characters	Undefined	KQL
VMWare-LPE-2022-22960	Undefined	KQL

Wazuh Core Ruleset

7 rules

Detection	Severity	Format
Executed suspicious process with right to left override character in binary file, possible malicious file masquerading	Critical	Wazuh XML
MS Graph message: Indicators that the system is infected with malware have been detected.	Critical	Wazuh XML
MS Graph message: Malware has been detected in the environment. This is a true positive alert.	Critical	Wazuh XML
Auditd: Execution of a file ended abnormally.	High	Wazuh XML
Cmd.exe executed from non-standard directory, may be related to link execution from mounted ISO file	High	Wazuh XML
MS Graph message: Indicators that the system is potentially infected with malware have been detected. Check the system for signs of infection.	High	Wazuh XML
Rundll32 executed from non-standard directory, may be related to link execution from mounted ISO file	High	Wazuh XML

chainguard-dev/osquery-defense-kit

7 rules · 6 families

Detection	Severity	Format
Catch programs that failed to run due to a launch constraint violation, such as a signing issue.	Undefined	osquery SQL
Look for sketchy mounted disk images, inspired by Shlayer 2 variants	Undefined	osquery SQL
Look for sketchy mounted disk images, inspired by Shlayer 2 variants	Undefined	osquery SQL
Scan removable volumes for sketchy files	Undefined	osquery SQL
Surface ISO/DMG disk images that were downloaded from unexpected places	Undefined	osquery SQL
Unexpected process that spawns shell processes (event based)	Undefined	osquery SQL
Unexpected process that spawns shell processes (event-based)	Undefined	osquery SQL

chronicle/detection-rules

5 rules

Detection	Severity	Format
aws_guardduty_malicious_or_suspicious_file_executed	High	YARA-L
aws_successful_api_from_tor_exit_node	High	YARA-L
gcp_successful_api_from_tor_exit_node	High	YARA-L
high_risk_user_download_executable_from_macro	High	YARA-L
google_workspace_malicious_file_downloaded	Medium	YARA-L

Bert-JanP/Hunting-Queries-Detection-Rules

4 rules

Detection	Severity	Format
File that contains malware detected by Defender For Cloud Apps	Undefined	KQL
Malicious PowerShell Executions From Clipboard Copy-and-Paste	Undefined	KQL
Malware File Detected In Office 365	Undefined	KQL
MITRE ATT&CK Mapping	Undefined	KQL

falcosecurity/rules

1 rule

Detection	Severity	Format
Program run with disallowed http proxy env	Low	Falco YAML