CyberStack

MITRE ATT&CK / Techniques / T1204.002

User Execution: Malicious File

ID
T1204.002
Tactics
TA0002 Execution
Sub-technique of
T1204 User Execution
Platforms
Linux, macOS, Windows
Data sources
File Creation, Process Creation, File Metadata
Source
attack.mitre.org
MITRE last modified
12 May 2026

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.[2]

Adversaries may employ various forms of Masquerading and Obfuscated Files or Information to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.[3]

While Malicious File frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.

Detection

Mitigations (3)

M1017 User Training

Use user training as a way to bring awareness to common phishing and spearphishing techniques and how to raise suspicion for potentially malicious events.

M1038 Execution Prevention

Application control may be able to prevent the running of executables masquerading as other files.

M1040 Behavior Prevention on Endpoint

On Windows 10, various Attack Surface Reduction (ASR) rules can be enabled to prevent the execution of potentially malicious executable files (such as those that have been downloaded and executed by Office applications/scripting interpreters/email clients or that do not meet specific prevalence, age, or trusted list criteria). Note: cloud-delivered protection must be enabled for certain rules. [1]

Groups (87)

Showing 60 of 87. Full list on attack.mitre.org.

Software (98)

Showing 60 of 98. Full list on attack.mitre.org.

References

  1. win10_asr
  2. Mandiant Trojanized Windows 10
  3. Password Protected Word Docs