Execution (MITRE ATT&CK Tactic)

What Execution Means in MITRE ATT&CK

Execution is the point where an adversary turns access into action. In ATT&CK terms, it covers running code, scripts, or commands on a target so the intrusion can begin staging, payload delivery, discovery, or follow-on control.

This tactic matters because execution is often the first observable sign that a malicious workflow has moved from preparation into activity. A defender who can identify abnormal process launches, script engines, shell invocations, or unusual command-line patterns can often interrupt the chain early.

How Execution Typically Appears in an Intrusion

Execution rarely happens in isolation. It is usually paired with phishing, exploitation, valid accounts, or other initial access paths, then followed by child processes, living-off-the-land binaries, or script interpreters that help the attacker stay flexible and blend in.

The practical question for analysts is not just whether a process started, but whether the parent-child relationship, execution context, and command content make sense for the host. A legitimate admin tool can be abused, while a suspicious script runner may simply be the visible shell around a deeper compromise.

For a broader view of ATT&CK tactics, technique relationships, and coverage mapping, see the MITRE ATT&CK Guide for Defenders.

Why Execution Is So Useful to Adversaries

Execution gives attackers a way to turn a foothold into capability. Once code is running, they can decode payloads in memory, call system utilities, chain additional scripts, or pivot into persistence and privilege escalation paths without immediately introducing obviously malicious binaries.

This is why defenders often treat execution controls as a boundary problem. If a system allows broad script execution, user-writable paths, or unrestricted interpreter use, an attacker may not need a novel exploit, only a permitted way to run something unexpected.

ATT&CK coverage is especially useful here because execution techniques often appear in combinations, and those combinations can be exposed by MITRE D3FEND countermeasures such as executable denylisting, script execution analysis, and process spawn analysis.

Detection and Hardening for Execution Paths

Good detection starts with visibility into process creation, command lines, script hosts, and parent-child process trees. The goal is to distinguish normal administration from abnormal execution, especially where the same tool can be used both legitimately and maliciously.

Hardening focuses on shrinking the number of places where code can run and the number of ways it can run. Application control, least privilege, macro and script restrictions, and tighter interpreter policy all help reduce the attacker's room to maneuver.

The most effective programs combine prevention with alerting. If a control blocks execution, the team still needs telemetry to see whether the attacker tried alternative launch paths, fallback scripts, or renamed utilities.

Operationally, the best external reference for the tactic itself is the MITRE ATT&CK Enterprise Matrix, which is the canonical source for tactic and technique mapping.

Risk and Threat Considerations

Execution is high risk because it is the moment an attacker converts access into active control. If defenders miss it, the same mechanism can be used to launch payloads, disable controls, stage persistence, or move into later ATT&CK tactics with far less friction.

Failure mechanism: Weak execution boundaries, excessive script permissions, and poor command-line visibility let malicious code run under a trusted user, process, or interpreter, making the intrusion look routine until the attacker has already advanced.

Impact: The result can be rapid expansion of compromise, including payload delivery, privilege escalation, defense evasion, and follow-on execution across additional hosts or accounts.

Practitioner Guidance

Why practitioners should care: Execution is one of the clearest places to stop attacker momentum, so teams should treat it as a control and detection priority rather than a generic endpoint event. The key judgement is whether the environment meaningfully constrains what can execute, where, and under whose authority.

What to watch for: Investigate unusual parent-child chains, script interpreters launched from office or browser processes, encoded command lines, and execution from temporary or user-writable locations. Those patterns often indicate abuse of a legitimate execution path rather than a custom malware binary.

Practitioner takeaway: Strong execution security is less about blocking every command and more about making unauthorized execution noisy, rare, and easy to distinguish from normal administration.

Related resources from NHI Mgmt Group

• What is an example of Execution (MITRE ATT&CK Tactic) in practice?
• Why do MITRE ATT&CK detections that reach Technique or Tactic level matter more than generic alerts?
• How does Execution in MITRE ATT&CK work?
• How can security teams detect execution activity in MITRE ATT&CK?