User Execution is the point where a phishing email, a fake error page or a poisoned package stops being a message and becomes code running under a real person's identity. MITRE ATT&CK tracks it as T1204 in the Execution tactic (TA0002), with five sub-techniques: Malicious Link, Malicious File, Malicious Image, Malicious Copy and Paste and Malicious Library. It is one of the most heavily used techniques in the knowledge base: ATT&CK v20 records T1204.002 Malicious File against 87 groups and 93 malware families, and T1204.001 Malicious Link against 50 groups. This guide is for detection engineers, SOC analysts and endpoint, developer platform and cloud owners. It covers the process chains that reveal each sub-technique, the telemetry to collect, the controls that stop untrusted code running and why the identity of the person who ran it decides the blast radius. It contains no attack procedures.
Key takeaways
- The user is the execution engine. T1204 needs no exploit: the adversary persuades someone to open, click, paste, pull or install, so the code runs with that person's privileges, tokens and network position.
- Detect the chain, not the click. Every ATT&CK detection strategy for T1204 is a sequence: a user-facing application handles content, then spawns an interpreter or writes an executable, then reaches out to the network.
- Mark of the Web is your best friend on Windows. Office blocks macros in files with Zone.Identifier ZoneId 3, and several Attack Surface Reduction rules key off provenance. Containers and archives that strip the mark undo this protection.
- Developers and cloud engineers are users too. T1204.003 (images) and T1204.005 (libraries) execute on build agents, laptops with cloud credentials and production clusters, so package and image allowlisting belong in the same programme as email filtering.
- Assume credentials were taken. The most common payloads after user execution are infostealers. Response must include revoking the user's sessions, tokens and any machine credentials on the device, not just reimaging it.
How the attack works
ATT&CK describes User Execution as an adversary relying on specific actions by a user to gain execution, typically following Phishing (T1566) but also later in an intrusion, for example a file planted on a shared drive or sent by Internal Spearphishing (T1534). The parent technique also covers persuading users to enable Remote Access Tools (T1219), to run JavaScript that leads to Steal Web Session Cookie (T1539), and tech support scams that combine calls and websites. The sub-techniques differ in what the user is persuaded to do and therefore where the evidence lands.
| Sub-technique | What the user does | Typical precursor | Platforms (ATT&CK v20) | Primary evidence |
|---|---|---|---|---|
| T1204.001 Malicious Link | Clicks a link that leads to a download, a browser exploit (T1203) or a file needing execution | Spearphishing Link (T1566.002), chat, search ads | Windows, macOS, Linux | Proxy and DNS logs, browser download history, new file in Downloads |
| T1204.002 Malicious File | Opens a document, archive, shortcut or installer (ATT&CK lists .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, .iso) | Spearphishing Attachment (T1566.001), shared folders, password-protected archives | Windows, macOS, Linux | Handler application spawning an interpreter, file creation with Zone.Identifier |
| T1204.003 Malicious Image | Deploys a backdoored AMI, cloud VM image or container image, often with a lookalike name | Upload Malware (T1608.001) to a public registry or marketplace | IaaS, Containers | Registry pull events, Kubernetes audit, CloudTrail RunInstances, unexpected egress after start |
| T1204.004 Malicious Copy and Paste | Pastes a command into Run, PowerShell or a terminal, the "ClickFix" fake CAPTCHA or fake error pattern | Drive-by Compromise (T1189), phishing with a fake error | Windows, macOS, Linux | Interpreter launched by explorer.exe or a terminal with encoded or download-and-run arguments, PowerShell 4104 |
| T1204.005 Malicious Library | Installs a typosquatted or compromised package from npm, PyPI or a code repository | Upload Malware (T1608.001), Compromise Software Dependencies (T1195.001) | Windows, macOS, Linux | Package manager execution followed by script writes, new outbound connections, credential file reads |
ATT&CK notes that adversaries combine T1204 with masquerading and obfuscation, such as familiar file names and password-protected archives with the password in the email body, because encrypted content defeats gateway scanning. ATT&CK notes copy and paste may bypass email filtering and browser sandboxing. The full pattern is covered in the ClickFix and Fake CAPTCHA Paste-and-Run Attacks Guide.
Where it shows up
- Corporate endpoints: the classic case. Email attachments, shortcut files (see the Malicious LNK Files Guide), disk images that do not carry Mark of the Web to their contents, and Office documents (see the Macro Malware Guide).
- Developer workstations and CI runners: package installs run lifecycle scripts automatically. Credentials on these machines are often more valuable than the user's own.
- Cloud and Kubernetes: an engineer launching a community AMI or pulling an image by mutable tag. ATT&CK's DET0248 flags pods created with the
latesttag or without a digest, and images from registries outside an allowlist. - Contractor and personal devices: user execution on an unmanaged machine still compromises corporate identities. See Lessons from incidents.
Impact
User Execution itself is an enabler. What it enables depends on whose session the code inherits.
- Credential and session theft: infostealers harvest browser cookies, saved passwords, cloud CLI profiles, SSH keys and API tokens within seconds. Session cookies can bypass MFA. See the Infostealer Threat Guide.
- Persistent remote access: remote access tools installed at the user's request give interactive control that looks like legitimate IT support.
- Supply chain propagation: stolen publishing tokens from a developer machine let the attacker publish further malicious packages, which is how worm-style npm campaigns spread.
Detection
ATT&CK v20 publishes detection strategies for each sub-technique. They share a shape: a user-facing process, then an unusual child or file write, then network activity, within a short time window. The table summarises the log sources each strategy names.
| Strategy | Chain to correlate | Windows sources | macOS and Linux sources | Cloud and container sources |
|---|---|---|---|---|
| DET0066 Malicious Link | Browser, Office or mail client handles URL, connects to untrusted domain, file lands in a user-writable path | Security 4688; Sysmon 3, 22, 11 | auditd execve and open/creat/rename in ~/Downloads, /tmp; unified log LSQuarantineAttach; fsevents | Proxy and DNS (uncommon TLDs, new domains, shorteners) |
| DET0294 Malicious File | Handler (Word, PDF reader, archiver) writes to Downloads, Temp or Desktop, then spawns powershell, wscript, cmd, regsvr32, rundll32 or msiexec | Sysmon 11, 1, 15 (FileCreateStreamHash, which records Zone.Identifier streams) | EndpointSecurity NOTIFY_CREATE plus exec of osascript, bash, curl from Preview, Word or Finder; auditd | None |
| DET0340 Malicious Copy and Paste | Interpreter started from a user session with encoded, download-and-run or pipe-to-shell arguments, optional temp drop, then egress | Security 4688; PowerShell 4103, 4104; Sysmon 11, 3, 22 | auditd execve of bash, sh, python with curl or wget piped to a shell or base64 decoding; Terminal or iTerm2 parent | NSM user agents typical of PowerShell or curl from desktops |
| DET0252 Malicious Library | pip, npm or brew install followed by new scripts in hidden or temp paths, startup changes or unexpected connections | Sysmon 1, 11 (writes in %APPDATA%, %TEMP%, %LOCALAPPDATA%) | auditd execve of package managers, new files in ~/.local, ~/.cache, /tmp within minutes; new LaunchAgents | Egress from interpreter to non-registry hosts |
| DET0248 Malicious Image | Pull from untrusted registry or new digest, container or instance start, then unexpected utilities or egress | Sysmon 1 inside guest | auditd execve in container namespace | containerd events; Kubernetes audit (mutable tag, no digest); CloudTrail RunInstances; Azure Activity virtualMachines/write with unknown image publisher |
Detection logic that works in practice
- Parent-child baselines: alert on WINWORD.EXE, EXCEL.EXE, OUTLOOK.EXE, AcroRd32.exe, browsers and archivers spawning script hosts or LOLBins. Microsoft Defender's Attack Surface Reduction rules turn several of these into prevention, and in audit mode they log event 1122 (block is 1121) in Microsoft-Windows-Windows Defender/Operational, which gives you a ready-made detection feed before you enforce.
- Explorer launching interpreters: the Run dialog executes as a child of explorer.exe. powershell.exe or mshta.exe launched from explorer.exe with encoded commands, hidden windows or web requests is a strong copy-and-paste signal. Enable PowerShell script block logging (4104) so the decoded content is captured.
- Provenance joins: correlate Sysmon 15 Zone.Identifier data, or macOS quarantine attributes, with the first execution of that file. Execution of a file with internet provenance from Downloads or an extracted archive path deserves a higher score.
- Package install windows: on developer endpoints and runners, treat outbound connections from node or python to hosts other than the package registry during an install as suspicious, along with reads of credential files such as cloud CLI profiles, .npmrc and SSH keys.
Metrics
- Percentage of Windows endpoints with the Office child-process and executable-content ASR rules in block mode, and the weekly count of 1121 events by rule.
- Mean time from first suspicious child process to host isolation and to user session revocation.
- Share of production pods running images by digest from approved registries.
Prevention and hardening
| Control | ATT&CK mitigation | What to configure | Sub-techniques covered |
|---|---|---|---|
| Application control | M1038 Execution Prevention | App Control for Business or AppLocker on Windows, fapolicyd on Linux; block execution from Downloads, Temp and user profile paths; PowerShell Constrained Language Mode for non-administrators | .002, .004 |
| Attack Surface Reduction rules | M1040 Behavior Prevention on Endpoint | Block all Office applications from creating child processes (d4f940ab-401b-4efc-aadc-ad5f3c50688a); Block executable content from email client and webmail (be9ba2d9-53ea-4cdc-84e5-9b1eeee46550); Block JavaScript or VBScript from launching downloaded executable content (d3e037e1-3eb8-44c8-a917-57927947596d); Block execution of potentially obfuscated scripts (5beb7efe-fd9a-4556-801d-275e5ffc04cc); Block executable files from running unless they meet a prevalence, age, or trusted list criterion (01443614-cd74-433a-b99e-2ecdc07bfc25) | .001, .002, .004 |
| Internet macro blocking | M1038 | Set "Block macros from running in Office files from the Internet" to Enabled per app (it is in the security baseline); Windows Microsoft 365 Apps for enterprise only | .002 |
| Web and file type filtering | M1021 Restrict Web-Based Content, M1031 Network Intrusion Prevention | Block .scr, .exe, .pif, .cpl, .iso, .lnk and similar types at mail and web gateways; sandbox or detonate archives; consider blocking newly registered domains | .001, .002, .004 |
| Internal package sources | M1033 Limit Software Installation | Developers and CI pull through a proxy registry with approved packages; set npm ignore-scripts where builds allow it (default false; explicit npm run scripts still run); pin by lockfile and hash | .005 |
| Signed and approved images | M1045 Code Signing, M1047 Audit | Admission policy that allows only approved registries and digest-pinned, signature-verified images; private AMI catalogue. Note Docker states its Notary v1 service behind Docker Content Trust shuts down on 8 December 2026, so plan signature verification on a supported tool | .003 |
| Awareness training | M1017 User Training | Train on fake CAPTCHA and fake fix prompts, password-protected attachments and lookalike packages; make reporting one click | All |
Roll out in rings: run ASR rules and application control in audit mode for two to four weeks, review 1122 and audit events with application owners, add narrow exclusions by path or signer rather than disabling rules, then move a pilot group to block. Keep a documented rollback (switch the rule back to audit through the same policy) so a business-critical false positive does not lead to the whole policy being removed. For application control design, see the Application Allowlisting Guide and the Office Macro Blocking Guide.
Where identity fits
Code started by T1204 inherits everything the user can reach, and on modern endpoints that includes non-human credentials: personal access tokens in .npmrc and .gitconfig, cloud CLI profiles, kubeconfig files and SSH keys used by automation. Reduce what a single execution can steal: keep long-lived tokens off endpoints, prefer short-lived federated credentials and hardware-bound phishing-resistant MFA, and bind sessions to devices where your identity provider supports it. When an execution is confirmed, revoke the user's refresh tokens and sessions and rotate every machine credential that was readable on the host. See the Infostealer Logs and Session Token Abuse Guide and the npm Tokens Security Guide.
Lessons from incidents
- Installs are executions: in the Nx s1ngularity attack of August 2025, a post-install script searched developer machines and CI runners for GitHub and npm tokens, SSH keys and cloud credentials; GitGuardian counted 2,349 distinct secrets across 1,079 exfiltration repositories, about half still valid when analysed. Disabling lifecycle scripts by default and keeping publishing tokens off workstations would have reduced both execution and impact.
- Unmanaged devices carry managed identities: Mandiant found the credentials behind the Snowflake breach came mainly from infostealer infections on systems Snowflake did not own, including contractor devices, with at least 79.7% of accounts used previously exposed in infostealer logs. It shows credentials harvested years earlier stay useful while MFA and rotation are missing.
Common failure patterns
- Training as the only control: M1017 is listed against every sub-technique, but on its own it fails to the one convincing message. Pair it with execution prevention.
- ASR left in audit forever: audit mode produces data nobody reviews. Set a date to move each rule to block.
- Provenance lost in transit: files extracted from some archive and disk image formats, or copied via a file share, can lose Mark of the Web, so macro and SmartScreen protections silently stop applying. Test your common delivery formats.
- Developer exemptions: excluding engineering laptops from application control and EDR policies because builds break leaves the users with the most credentials least protected.
- Reimage without revocation: cleaning the host but leaving stolen cookies, tokens and keys valid lets the adversary return without the endpoint.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.PS-05, DE.CM-09, PR.AT-01 | Prevent unauthorised software execution, monitor endpoints and runtimes, train personnel |
| NIST SP 800-53 Rev. 5 | CM-7(5), CM-11, SI-3, SI-4, SI-8, SC-18, SC-44, AT-2(3) | Allow-by-exception software, user-installed software, malicious code protection, monitoring, spam protection, mobile code, detonation chambers, social engineering training |
| MITRE D3FEND | D3-EAL Executable Allowlisting, D3-FA File Analysis, D3-URA URL Reputation Analysis, D3-PSA Process Spawn Analysis | Countermeasures for blocking and detecting the execution chain |
| ISO/IEC 27001:2022 Annex A | A.8.7 Protection against malware, A.8.19 Installation of software on operational systems, A.6.3 Information security awareness, education and training | Management system controls covering the same ground |
Practitioner checklist
- Enable the Office, email and script ASR rules in audit, review 1122 events, then move them to block with documented exclusions.
- Set "Block macros from running in Office files from the Internet" to Enabled for every Office app.
- Block execution from user-writable paths with application control and use Constrained Language Mode for standard users.
- Collect Sysmon 1, 3, 11, 15 and 22, Security 4688 and PowerShell 4104 on Windows, auditd on Linux and EndpointSecurity on macOS, and build chain correlations for each ATT&CK detection strategy.
- Route developer and CI package installs through an internal registry and disable install scripts where builds allow it.
- Admit only digest-pinned, signature-verified images from approved registries, and alert on new AMIs or image publishers.
- Block high-risk file types at mail and web gateways and detonate password-protected archives.
- Write the response runbook to revoke sessions and rotate all user and machine credentials present on an affected host.
Standards and references
- MITRE ATT&CK: User Execution (T1204)
- MITRE ATT&CK: Malicious Copy and Paste (T1204.004)
- Microsoft Learn: Attack surface reduction rules reference
- Microsoft Learn: Troubleshoot attack surface reduction rules
- Microsoft Learn: Macros from the internet are blocked by default in Office
- npm Docs: config (ignore-scripts)
- Docker Docs: Content trust in Docker
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: T1059 Command and Scripting Interpreter Defensive Guide · ClickFix and Fake CAPTCHA Paste-and-Run Attacks Guide · Malicious Package and Dependency Confusion Guide · Phishing Guide · Infostealer Threat Guide