ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Techniques

T1204.002sub-technique

Malicious File

Tactics: execution

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including.doc,.pdf,.xls,.rtf,.scr,.exe,.lnk,.pif,.cpl,.reg, and.iso. Adversaries may employ various forms of Masquerading and Obfuscated Files or Information to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it. While Malicious File frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.

MITRE ATT&CK ↗

Linked entities · 24

subtechnique-ofT1204User Execution uses byG0082APT38 uses byG0119Indrik Spider uses byG0066Elderwood uses byG1008SideCopy uses byG0094Kimsuky uses byG1011EXOTIC LILY uses byG0018admin@338 uses byG0040Patchwork uses byG0035Dragonfly uses byG0078Gorgon Group uses byG0045menuPass uses byG0050APT32 uses byG0069MuddyWater uses byG0019Naikon uses byG0037FIN6 uses byG0047Gamaredon Group uses byG0084Gallmaker uses byG1046Storm-1811 uses byG0046FIN7 uses byG0034Sandworm Team uses byG0095Machete uses byG0138Andariel uses byG1012CURIUM