What is an example of Execution (MITRE ATT&CK Tactic) in practice?

How Execution Appears in Real Intrusions

Execution is the moment a threat actor gets code to run in a target environment, so the practical example is not just “someone typed a command.” It is the stage where a script, loader, macro, remote shell, scheduled task, or injected payload actually runs on the host or account the attacker reached. That running code is what turns access into active control.

In practice, execution often follows an earlier access step and immediately enables follow-on behaviour such as downloading tools, unpacking a second-stage payload, opening an interactive shell, or calling other system utilities. On Windows, defenders may see PowerShell, WMI, cmd.exe, mshta, rundll32, or a script host appear where they are not expected. On Linux and macOS, suspicious shell commands, interpreter launches, or unusual execve activity can serve the same role.

The important distinction is that execution is about runtime behaviour, not delivery alone. A malicious attachment, link, or dropped file may be the delivery method, but execution begins when the payload is interpreted or launched and starts affecting the system. That is why ATT&CK examples of execution often overlap with script interpreters, command-line abuse, and process spawning rather than with email or web delivery techniques.

What Defenders Should Look for When Code Starts Running

Execution is usually visible in process creation and child-process chains, especially when a parent process launches something atypical for that environment. A browser spawning a script engine, a document reader launching a shell, or a service process starting an interpreter are all signs that the attacker has moved from access to action. Monitoring command lines, execution context, and parent-child relationships gives the clearest picture of what the code is trying to do.

The strongest detections usually combine process telemetry with script content, module loads, and network follow-up. A single suspicious command may be noisy, but a command that immediately reaches out for a payload, writes a file, or starts persistence is more meaningful. For ATT&CK-oriented hunting, use the execution event as the anchor and then follow the chain into persistence, defense evasion, credential access, or lateral movement if the process tree shows those next steps.

Execution can also be subtle when attackers abuse trusted tooling. Living-off-the-land binaries, embedded scripts, signed utilities, and remote management tools can all make malicious execution look routine. That is why defenders should pay attention not just to what ran, but to whether it ran from an unusual parent process, under an odd account, from an unexpected path, or with arguments that indicate staging or evasion.

Why Execution Matters in the ATT&CK Chain

Execution is often the first point where an intrusion becomes operationally dangerous. Once code runs, the adversary can adapt in real time, test privileges, enumerate the host, and decide whether to stay local or pivot. The step matters because it is where a one-time foothold becomes an interactive capability that can be extended, automated, or hidden.

It is also the stage where defenders can most cleanly connect ATT&CK technique mapping to response. A good detection will not just say “a script ran.” It will show what launched it, what it attempted, whether it created additional processes, and whether it touched sensitive data or external infrastructure. That context helps separate harmless administration from malicious execution.

For a practical ATT&CK reference, the MITRE ATT&CK Guide for Defenders is useful when you want to map execution telemetry to the broader technique set and build detection coverage around the tactic. For a defensive countermeasure view, the MITRE D3FEND Guide helps connect process-spawn and script-execution observations to specific mitigation and analytic patterns.

Risk and Threat Considerations

Execution is attractive to attackers because it converts a passive presence into active control. Once malicious code runs, the attacker can stage additional payloads, harvest data, disable protections, or establish persistence, often using the same trusted tools defenders rely on. The risk is highest when execution happens under a privileged account, a service context, or a user session with broad access.

Failure mechanism: A malicious script, macro, command, or loader executes with enough authority to perform follow-on actions before security monitoring or application controls stop it. If command-line logging, script-block visibility, or process ancestry analysis is weak, the execution event can look like ordinary administration.

Impact: The environment can progress from initial access to payload staging, persistence, lateral movement, or destructive actions. Even a short-lived execution window can be enough to drop tools, contact a command-and-control server, or trigger the next intrusion phase.

Practitioner Guidance

What to verify: Treat the parent process, command line, user context, and network follow-on as a single investigative unit. If one of those elements looks normal but the others do not, assume the execution chain deserves review rather than dismissing it as routine activity.

Decision rule: If the executed code came from a user-facing application, script host, or remote management path that is not expected in that workflow, prioritise containment and triage over hunting for perfect attribution. If the process also launched child processes or touched sensitive resources, escalate immediately.

Practitioner takeaway: Execution is the point where intrusion becomes observable as behaviour, so the defender’s job is to preserve process lineage, command context, and next-step activity before the attacker can blend into normal administration.

Related resources from NHI Mgmt Group

• Why do MITRE ATT&CK detections that reach Technique or Tactic level matter more than generic alerts?
• How does Execution in MITRE ATT&CK work?
• How should security teams use MITRE ATT&CK in identity programmes?
• Why does MITRE ATT&CK matter for NHI governance?