T1204: User Execution
AI Answer
An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of [Phishing](https://attack.mitre.org/techniques/T1566). While [User (Source: MITRE ATT&CK T1204)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1204 |
| Name | User Execution |
| Tactic | Execution (execution) |
| Platforms | Linux, Windows, macOS, IaaS, Containers |
| Sub-technique | No |
Why it matters
In the OpenTrojan knowledge graph, User Execution (T1204) is one of the highest-connectivity ATT&CK techniques: 5 MITRE STIX relationships reference this technique; 2 threat groups observed using it; 2 software families associated; 1 campaigns associated; 2 OpenTrojan content pages reference it. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1204). An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user’s desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies * Downloading and executing malware for User Execution * Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.
Detection
Not available — MITRE ATT&CK does not currently publish a structured detection strategy for this technique in the ingested dataset.
Mitigation
Use intrusion detection signatures to block traffic at network boundaries.
Mitigation guidance is from the MITRE ATT&CK course-of-action associated with this technique.
Related Software
- Raspberry Robin
- Lumma Stealer
Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).
Related Threat Groups
- Scattered Spider
- LAPSUS$
Group associations are from MITRE ATT&CK STIX relationships.
Related Campaigns
- Water Curupira Pikabot Distribution
Campaign associations are from MITRE ATT&CK STIX relationships.
Related Content
References
- https://attack.mitre.org/techniques/T1204
- https://krebsonsecurity.com/2023/05/discord-admins-hacked-by-malicious-bookmarks
- https://www.reliaquest.com/blog/new-execution-technique-in-clearfake-campaign
- https://www.proofpoint.com/us/blog/threat-insight/caught-beneath-landline-411-telephone-oriented-attack-delivery
- https://blog.talosintelligence.com/roblox-scam-overview
- https://www.proofpoint.com/us/blog/threat-insight/clipboard-compromise-powershell-self-pwn
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1204 User Execution. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1204 User Execution?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.