MITRE ATT&CK / T1204
T1204
User Execution
Description
An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of [Phishing](https://attack.mitre.org/techniques/T1566).While [User Execution](https://attack.mitre.org/techniques/T1204) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534).Adversaries may also deceive users into performing actions such as:* Enabling [Remote Access Tools](https://attack.mitre.org/techniques/T1219), allowing direct control of the system to the adversary * Running malicious JavaScript in their browser, allowing adversaries to [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539)s(Citation: Talos Roblox Scam 2023)(Citation: Krebs Discord Bookmarks 2023) * Downloading and executing malware for [User Execution](https://attack.mitre.org/techniques/T1204) * Coerceing users to copy, paste, and execute malicious code manually(Citation: Reliaquest-execution)(Citation: proofpoint-selfpwn)For example, tech support scams can be facilitated through [Phishing](https://attack.mitr…
Platforms
Mitigations
- M1017 — User Training
- M1038 — Execution Prevention
- M1040 — Behavior Prevention on Endpoint
- M1021 — Restrict Web-Based Content
- M1031 — Network Intrusion Prevention
- M1033 — Limit Software Installation
Use our free MITRE ATT&CK lookup tool, or browse the full ATT&CK matrix.
Our coverage
- LummaC2 Infostealer Targets US Critical Infrastructure: CISA-FBI Advisory AA25-141B and DOJ Domain Seizures
- ACSC Warns: ClickFix Campaign Delivers Vidar Stealer via Compromised Australian WordPress Sites
- North Korea Cryptocurrency Theft Tactics 2026: How DPRK Seized 76% of All Stolen Crypto
- FEMITBOT: Telegram Mini Apps Used for Crypto Scams and Android Malware Delivery
- DEEP#DOOR Python Backdoor Detection: YARA Rules, Network IOCs, and Credential Theft Defences
Source: MITRE ATT&CK Enterprise matrix. View on attack.mitre.org →