Log in Request a demo

Attack technique

User Execution

User Execution is when an attacker gets a person to run malicious code for them.

In short

User Execution is when an attacker gets a person to run malicious code for them. The person might open a file, click a link or turn on a remote access tool without knowing the risk. It is an Execution technique in MITRE ATT&CK.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Execution · Step 4 Of 15 In The Attack Chain

  1. MITRE IDT1204ATT&CK technique
  2. Detection3ways to spot itFollow the whole chain · Cover all platforms
  3. Defences4ways to stop itTrain users · Limit what can run

How it works

This technique relies on social engineering. Instead of breaking in by force, the attacker persuades a user to take the action that starts the code.

Common examples are opening a document, clicking a link, downloading malware, running a malicious script or enabling a remote access tool. Tech support scams that use spoofed call centers and malicious websites also fit here.

It often comes after phishing or another way in, but MITRE notes it can happen at any stage of an intrusion. MITRE lists five sub-techniques: T1204.001 Malicious Link, T1204.002 Malicious File, T1204.003 Malicious Image, T1204.004 Malicious Copy and Paste and T1204.005 Malicious Library.

A real example

  • MITRE ATT&CK lists LAPSUS$ as recruiting employees or contractors who hand over credentials and approve an MFA prompt, or who install remote management software on a corporate workstation.
  • MITRE ATT&CK lists Lumma Stealer as distributed through a fake CAPTCHA that tells the victim to open the Windows Run window and paste clipboard contents, which runs an encoded PowerShell command.
  • MITRE ATT&CK lists Raspberry Robin as relying on users directly opening malicious LNK files.
  • MITRE ATT&CK lists Scattered Spider as posing as IT and helpdesk staff to tell victims to run commercial remote access tools for initial access.
  • MITRE ATT&CK lists Water Curupira Pikabot Distribution (a campaign in MITRE's data) as requiring users to open malicious attachments to start the Pikabot install.

How to detect

  1. Follow the whole chain

    MITRE describes a typical pattern: a user works in an app, a file is created or extracted, that app starts a new process, and the device then connects out to the network.

  2. Cover all platforms

    Watch for this pattern on Windows, macOS and in cloud environments, and treat an unexpected child process started from a document or browser as a reason to investigate.

  3. Data sources MITRE lists

    Application Log Content, Container Creation, Container Start, File Access, File Creation, File Modification, Instance Creation, Instance Start, Network Connection Creation, Network Traffic Content, Process Creation

How to defend

  1. Train users

    Teach staff to spot phishing and other tricks that push them to open files, click links or approve tools.

  2. Limit what can run

    Use application control so that disguised or untrusted programs cannot start, and limit software installation to approved internal sources.

  3. Block risky content

    Block malicious downloads and suspicious file types at the network and web layer.

  4. Use attack surface reduction

    Turn on endpoint rules that stop common risky behavior from office and browser applications.

Questions

What is User Execution in MITRE ATT&CK?

User Execution (T1204) is an Execution technique where an attacker gets a person to run malicious code for them. The person might open a document, click a link, download malware, run a script or enable a remote access tool without knowing the risk.

How does a User Execution attack work?

It relies on social engineering. Instead of breaking in by force, the attacker persuades a user to take the action that starts the code. It often follows phishing or another way in, but MITRE notes it can happen at any stage of an intrusion.

How can I detect User Execution?

Follow the whole chain: a user works in an app, a file is created or extracted, that app starts a new process, and the device then connects out to the network. Treat an unexpected child process started from a document or browser as a reason to investigate.

How do I defend against User Execution?

Train staff to spot phishing and other tricks that push them to open files, click links or approve tools. Use application control so untrusted programs cannot start, and limit software installation to approved internal sources.

In our research

  1. ATT&CK groups by attributed origin: what is mapped October 2026
  2. ATT&CK techniques most used across threat groups October 2026
  3. Malicious Document Analysis for SOC Analysts May 2026
  4. APT38: From SWIFT Heists to Crypto Fortresses September 2025
  5. UNC1549 MINIBUS Backdoor Technical Analysis March 2025
  6. [Research Summary]: Rugmi Loader August 2024

Sources

  1. MITRE ATT&CK T1204: User Execution MITRE
  2. MITRE ATT&CK Tactic TA0002: Execution MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Read more

Threat group

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Read more