Almost every intrusion has to run code or instructions on a system the attacker does not own, and the Execution tactic (TA0002) in MITRE ATT&CK is where that happens. ATT&CK v20 defines the tactic as the adversary "trying to run malicious code or instructions on a system", and it pairs with every other tactic: the same PowerShell session that runs a payload also performs discovery, credential theft and collection. This guide maps the 22 Execution techniques in v20, shows where they appear in real environments (endpoints, cloud control planes, CI/CD pipelines, hypervisors and now LLM agents), and spends most of its length on detection, prevention and response. It is written for SOC analysts, detection engineers and platform owners.
Key takeaways
- Execution is the most procedure-heavy tactic in ATT&CK. In the v20 dataset Windows Command Shell (T1059.003) has 389 recorded uses by groups, software and campaigns, PowerShell (T1059.001) 237, Native API (T1106) 236 and Malicious File (T1204.002) 197.
- Most execution uses tools you already run. Shells, WMI, scheduled tasks, services, software deployment tools and cloud run-command features are administrative channels, so detection depends on context (who, from where, parent process, timing), not on the binary name.
- The tactic now reaches beyond the endpoint. v20 includes Cloud Administration Command (T1651), Serverless Execution (T1648), ESXi Administration Command (T1675), Poisoned Pipeline Execution (T1677) and two prompt injection techniques, T1698 Indirect and T1699 Direct.
- Allowlisting is the control that changes the odds. MITRE maps M1038 Execution Prevention to most Execution techniques; application control in audit mode first, then enforced in rings, removes whole classes of execution.
- Execution is usually carried out by an identity. Remote WMI, service creation, deployment tools and cloud run-command all need credentials, so privileged and machine identities are part of the execution attack surface.
How the attack works
Initial access (phishing T1566, exploitation of a public-facing application T1190, valid accounts T1078) gives the adversary a position; execution turns that position into running code. The techniques fall into five families.
| Family | ATT&CK v20 techniques | What the adversary relies on |
|---|---|---|
| Interpreters and native interfaces | T1059 Command and Scripting Interpreter (13 sub-techniques from PowerShell to Container CLI/API), T1106 Native API, T1129 Shared Modules, T1559 Inter-Process Communication (COM, DDE) | Built-in languages and OS interfaces that are present on every system |
| User-triggered | T1204 User Execution (Malicious Link, Malicious File, Malicious Image, Malicious Copy and Paste, Malicious Library), T1203 Exploitation for Client Execution | A person opening a file, clicking a link, pasting a command, or a vulnerable browser, Office or reader application |
| OS scheduling and services | T1053 Scheduled Task/Job, T1569 System Services (Service Execution, Launchctl, Systemctl), T1047 Windows Management Instrumentation, T1197 BITS Jobs, T1574 Hijack Execution Flow | Management features that run code locally or remotely, often as SYSTEM or root |
| Management planes | T1072 Software Deployment Tools, T1651 Cloud Administration Command, T1648 Serverless Execution, T1609 Container Administration Command, T1610 Deploy Container, T1675 ESXi Administration Command, T1677 Poisoned Pipeline Execution | Centralised tools that push code to many systems; one compromised administrative identity reaches the whole fleet |
| Proxy, input and AI | T1127 Trusted Developer Utilities Proxy Execution (MSBuild, ClickOnce, JamPlus), T1674 Input Injection, T1698 Indirect Prompt Injection, T1699 Direct Prompt Injection | Trusted signed utilities, simulated keystrokes, or an LLM agent that acts on instructions hidden in content |
Many techniques sit in several tactics (Scheduled Task is also Persistence and Privilege Escalation), and the line between administration and attack is intent: PowerShell, WMI and Systems Manager Run Command are used legitimately every day. For the broader picture of abusing built-in tools, see the Living off the Land Guide.
The newer techniques worth knowing
- T1651 Cloud Administration Command: ATT&CK describes adversaries with administrative access to a cloud environment using services such as AWS Systems Manager, Azure RunCommand and Runbooks to run scripts inside virtual machines through the installed agents. See the T1651 Cloud Administration Command Defensive Guide.
- T1677 Poisoned Pipeline Execution: injecting code into a CI/CD build, either directly by modifying the CI configuration file or indirectly through files the pipeline consumes. See the OWASP CI/CD Top 10 CICD-SEC-4 Poisoned Pipeline Execution Guide.
- T1698 and T1699 Prompt Injection: ATT&CK describes indirect prompts embedded in web pages, documents, emails, tickets and code that an agent later processes, and direct prompts typed into the model interface to bypass safeguards. See the Prompt Injection Guide.
Where it shows up
- Phishing follow-on: a malicious document or link (T1204.001, T1204.002) leads to an Office or browser process spawning a shell or script host. See the Macro Malware Guide.
- Exploited servers: after T1190, the web server or application pool process spawns cmd.exe, PowerShell or a Unix shell. Server worker processes rarely need a shell, so this is a strong signal.
- Ransomware deployment: operators commonly push encryptors through T1072 Software Deployment Tools, group policy scheduled tasks (T1053.005) or remote service creation (T1569.002) once they hold domain or tool administrator rights.
- CI/CD: build runners execute whatever the pipeline definition and its dependencies tell them to, with the pipeline's secrets in memory.
Impact
Execution itself rarely causes the damage; it enables the tactics that do. Code that is contained in a browser sandbox as a standard user is a nuisance; the same code running as SYSTEM through a service, as root on an ESXi host, or as a pipeline runner holding production deployment credentials can reach Credential Access, Lateral Movement and Impact within minutes. Management-plane techniques (T1072, T1651, T1675) are the most dangerous because one action executes on hundreds or thousands of systems at once. Execution is often the first point at which an intrusion becomes observable on a host.
Detection
ATT&CK v20 attaches a detection strategy (DET identifier) to each technique, with platform-specific analytics that name the log sources to collect. The table summarises the strategies that cover most real execution activity.
| Technique | v20 detection strategy | Key log sources named in the analytics | What to look for |
|---|---|---|---|
| T1059 Command and Scripting Interpreter | DET0516 | Sysmon Event ID 1 (Windows), auditd execve (Linux), macOS unified log, ESXi vobd shell session start, network device CLI logs | Interpreters launched outside expected administrative windows, from unusual user contexts or parents, with encoded or obfuscated arguments |
| T1047 WMI | DET0364 | Sysmon Event IDs 1, 3 and 22; WMI-Activity events 5857, 5858, 5860, 5861 | WmiPrvSE.exe spawning shells, remote WMI with a matching network connection, new permanent event subscriptions |
| T1203 Exploitation for Client Execution | DET0287 | Windows Application Event ID 1000, Sysmon Event IDs 1 and 11, auditd, macOS unified log | A browser, Office or reader crash followed by a file write in a user-writable path and an unexpected child process |
| T1204 User Execution | DET0478 | Security Event ID 4688, Sysmon Event ID 11, docker events, CloudTrail RunInstances | Document or link open, then unpacking, then a living-off-the-land binary, then new outbound connections |
| T1651 Cloud Administration Command | DET0545 | CloudTrail SendCommand, StartSession and ExecuteCommand; Azure activity log runCommand action | Run-command calls by unexpected principals, outside change windows, or against many instances at once |
| T1677 Poisoned Pipeline Execution | DET0533 | SaaS CI/CD audit logs (for example GitHub) | Workflows triggered from forked repositories through pull_request_target, secrets accessed or exported, encoded data in artefacts |
Building the telemetry
- Process creation with command line: enable Security Event ID 4688 with command-line capture, or deploy Sysmon Event ID 1, which also records parent image and hashes. See the Sysmon Guide.
- Script content: enable PowerShell script block logging (Event ID 4104), which records deobfuscated script blocks as they run. See the PowerShell Security Guide.
- Linux and hypervisors: auditd rules on execve for interactive and service accounts; forward ESXi shell and SSH session events.
- Cloud and SaaS: collect CloudTrail management events, the Azure activity log and CI/CD platform audit logs centrally.
- EDR: process tree and API telemetry for T1106 and T1129, which leave little in native logs. See the EDR Guide.
High-value analytics
- Parent-child anomalies: Office applications, browsers, PDF readers, w3wp.exe, java, tomcat or sqlservr.exe spawning cmd.exe, powershell.exe, wscript.exe, mshta.exe, bash or sh.
- Remote execution pairs: a new service install (System Event ID 7045) or scheduled task creation (Security Event ID 4698) on a host, correlated with a network logon (Event ID 4624 logon type 3) from an administrative workstation that does not normally manage it.
- Deployment and run-command at scale: one principal executing on more hosts than its 30-day baseline, or a deployment package created and pushed outside change control.
Metrics that show it is working
- Telemetry coverage: percentage of endpoints and servers sending process creation with command line and script block logs.
- Technique coverage: number of the 22 Execution techniques with at least one tested analytic, tracked with the MITRE ATT&CK Coverage Mapping Guide.
- Enforcement coverage: share of devices with application control in enforced mode, and count of audit-mode blocks still unresolved.
- Time to detect: median time from a purple-team execution test to an alert in the SOC queue.
Prevention and hardening
MITRE maps a consistent set of mitigations across the tactic: M1038 Execution Prevention, M1040 Behavior Prevention on Endpoint, M1042 Disable or Remove Feature or Program, M1045 Code Signing, M1026 Privileged Account Management and, for client exploits, M1050 Exploit Protection and M1051 Update Software.
| Control | Techniques it reduces | Example implementation |
|---|---|---|
| Application and script allowlisting (M1038) | T1059, T1204, T1127, T1129 | Windows App Control for Business or AppLocker; App Control also covers scripts, MSI files, batch files and puts interactive PowerShell into Constrained Language Mode |
| Behaviour blocking (M1040) | T1204, T1203, T1047, T1059 | Microsoft Defender attack surface reduction rules such as "Block all Office applications from creating child processes", "Block execution of potentially obfuscated scripts" and "Block process creations originating from PSExec and WMI commands" |
| Remove or restrict features (M1042) | T1059.005, T1059.007, T1559.002 | Block Office macros from the internet, disable Windows Script Host where unused, remove PowerShell 2.0. See the Office Macro Blocking Guide. |
| Privileged access (M1026, M1018) | T1047, T1569, T1072, T1651, T1609, T1675 | Tiered administration, no standing admin rights on deployment tools, scoped IAM for run-command permissions, separate ESXi administrator accounts |
| Patch and exploit protection (M1051, M1050) | T1203 | Fast browser and Office updates, prioritising CISA KEV entries; see the Patch Management Guide |
| Pipeline controls (M1054, M1018) | T1677 | Protected branches, required review for CI configuration files, no secrets for workflows from forks, pinned third-party actions |
Phased rollout
- Baseline: collect process, script and cloud run-command telemetry for 30 days and list which interpreters and management tools each team actually uses.
- Audit: deploy attack surface reduction rules and application control policies in audit mode; review blocked-in-audit events by application owner.
- Pilot ring: enforce on IT and security staff devices first, then a business pilot group, with a documented exception request route.
- Broad enforcement: move to block or enforced mode in rings; servers and privileged access workstations get stricter policies than general user devices.
- Rollback: keep the previous policy version signed and ready, and use per-rule exclusions or a return to audit mode for a single ring rather than switching protection off fleet-wide. Track every exclusion with an owner and expiry. See the EDR Tuning and Exclusions Management Guide.
Decision guidance
- Allowlisting versus behaviour rules: allowlisting gives the strongest protection on fixed-function systems (servers, kiosks, privileged workstations); behaviour rules are faster to deploy on diverse user fleets where software changes weekly. Most organisations need both.
- Small organisations: start with macro blocking, the key attack surface reduction rules and managed EDR.
- Large organisations: invest in management-plane controls first, because one compromised deployment or cloud administrator account outweighs thousands of individual endpoints.
Framework mapping
| Framework | Relevant references |
|---|---|
| NIST CSF 2.0 | PR.PS-05 (installation and execution of unauthorised software are prevented), PR.PS-01, DE.CM-09 |
| NIST SP 800-53 Rev. 5 | CM-7 Least Functionality, CM-7(2) Prevent Program Execution, CM-7(5) Authorized Software, CM-11, SI-3, SI-4, SI-16, AU-12 |
| CIS Controls v8.1 | Control 2 Inventory and Control of Software Assets (allowlisting of software, libraries and scripts), Control 8 Audit Log Management, Control 10 Malware Defenses |
| MITRE D3FEND | D3-EAL Executable Allowlisting, D3-PSA Process Spawn Analysis, D3-SEA Script Execution Analysis |
Where identity fits
Remote execution techniques are authenticated actions. WMI and service execution need administrative credentials on the target; deployment tools, cloud run-command and pipelines run under service accounts, IAM roles and tokens that are frequently over-privileged and never reviewed. Treat identities that can execute at scale as Tier 0: remove standing access, scope permissions such as ssm:SendCommand to instance tags, and alert on use from new locations. See the CI/CD Pipeline Identity Security Guide.
Lessons from incidents
- Pipelines execute what they are given: in the tj-actions/changed-files compromise (March 2025), a stolen bot token was used to repoint release tags to a malicious commit, and every workflow that ran the action executed a script that read runner memory and printed secrets to the build log. Pinning actions to commit hashes would have prevented it.
- Agents are an execution surface: in the Amazon Q Developer extension compromise (July 2025), an over-scoped token in a build configuration let an attacker add a prompt instructing the coding agent to wipe local files and delete cloud resources through the user's AWS CLI profiles. AWS stated the code failed; agent tool permissions define the blast radius of prompt injection.
Common failure patterns
- Logging the binary, not the context: alerting on every powershell.exe launch produces noise and disabled rules; parent, user and command line separate attack from administration.
- Audit mode forever: application control and attack surface reduction rules left in audit mode for years give visibility but no protection.
- Broad exclusions: excluding whole folders or script hosts from EDR to fix one application creates a known safe path for attackers.
- Ignoring the management plane: endpoint controls are bypassed entirely when the adversary uses the organisation's own deployment tool or cloud run-command with a stolen administrator credential.
Practitioner checklist
- Collect process creation with command line (Event ID 4688 or Sysmon Event ID 1) and PowerShell Event ID 4104 from all Windows systems.
- Build parent-child analytics for Office, browser and server worker processes spawning interpreters.
- Move the key attack surface reduction rules from audit to block in rings, with owned and expiring exclusions.
- Pilot application control on servers and privileged access workstations, including script enforcement.
- Block internet macros and remove unused script hosts and PowerShell 2.0.
- Inventory every identity that can run code at scale (deployment tools, run-command, pipelines, ESXi) and remove standing privilege.
- Protect CI configuration files with required review and pin third-party actions to commit hashes.
- Test each Execution analytic quarterly and track coverage against the v20 technique list.
Standards and references
- MITRE ATT&CK: Execution (TA0002)
- MITRE ATT&CK: Command and Scripting Interpreter (T1059)
- MITRE ATT&CK: Cloud Administration Command (T1651)
- MITRE ATT&CK: Poisoned Pipeline Execution (T1677)
- Microsoft Learn: Attack surface reduction rules reference
- Microsoft Learn: Application Control for Windows
- NIST: SP 800-53 Rev. 5
- CIS: CIS Controls v8.1
Related NHI Mgmt Group resources: MITRE ATT&CK Guide for Defenders · T1059 Command and Scripting Interpreter Defensive Guide · Living off the Land Guide · ATT&CK Detection Strategies and Analytics Guide