T1204.002: Malicious File
AI Answer
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001). Adversaries may use several types of (Source: MITRE ATT&CK T1204.002)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1204.002 |
| Name | Malicious File |
| Tactic | Execution (execution) |
| Platforms | Linux, macOS, Windows |
| Sub-technique | Yes |
Why it matters
In the OpenTrojan knowledge graph, Malicious File (T1204.002) is one of the highest-connectivity ATT&CK techniques: 196 MITRE STIX relationships reference this technique; 86 threat groups observed using it; 98 software families associated; 12 campaigns associated. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1204.002). An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso. Adversaries may employ various forms of Masquerading and Obfuscated Files or Information to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it. While Malicious File frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user’s desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.
Detection
Not available — MITRE ATT&CK does not currently publish a structured detection strategy for this technique in the ingested dataset.
Mitigation
User Training involves educating employees and contractors on recognizing, reporting, and preventing cyber threats that rely on human interaction, such as phishing, social engineering, and other manipulative techniques. Comprehensive training programs create a human firewall by empowering users to be an active component of the organization’s cybersecurity defenses. This mitigation can be implemented through the following measures:
Create Comprehensive Training Programs:
- Design training modules tailored to the organization’s risk profile, covering topics such as phishing, password management, and incident reporting.
- Provide role-specific training for high-risk employees, such as helpdesk staff or executives.
Use Simulated Exercises:
- Conduct phishing simulations to measure user susceptibility and provide targeted follow-up training.
- Run social engineering drills to evaluate employee responses and reinforce protocols.
Leverage Gamification and Engagement:
- Introduce interactive learning methods such as quizzes, gamified challenges, and rewards for successful detection and reporting of threats.
Incorporate Security Policies into Onboarding:
- Include cybersecurity training as part of the onboarding process for new employees.
- Provide easy-to-understand materials outlining acceptable use policies and reporting procedures.
Regular Refresher Courses:
- Update training materials to include emerging threats and techniques used by adversaries.
- Ensure all employees complete periodic refresher courses to stay informed.
Emphasize Real-World Scenarios:
- Use case studies of recent attacks to demonstrate the consequences of successful phishing or social engineering.
- Discuss how specific employee actions can prevent or mitigate such attacks.
Mitigation guidance is from the MITRE ATT&CK course-of-action associated with this technique.
Related Software
- TrickBot
- BLINDINGCAN
- Ninja
- Bumblebee
- KOPILUWAK
- ThreatNeedle
- Havoc
- StrongPity
- Pony
- ROAMINGHOUSE
- AppleSeed
- NETWIRE
Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).
Related Threat Groups
- APT38
- Indrik Spider
- Elderwood
- SideCopy
- Kimsuky
- EXOTIC LILY
- admin@338
- Patchwork
- Dragonfly
- Gorgon Group
- menuPass
- APT32
Group associations are from MITRE ATT&CK STIX relationships.
Related Campaigns
- Operation Dream Job
- Frankenstein
- RedDelta Modified PlugX Infection Chain Operations
- Operation Sharpshooter
- Operation Honeybee
- Operation Dust Storm
- 2015 Ukraine Electric Power Attack
- Operation Spalax
- Water Curupira Pikabot Distribution
- C0015
- Operation AkaiRyū
- C0011
Campaign associations are from MITRE ATT&CK STIX relationships.
References
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1204.002 Malicious File. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1204.002 Malicious File?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.