{ "technique_id": "T1204", "name": "User Execution", "priority": "high", "status": "complete", "version": "0.1.0", "last_reviewed": "2026-07-23", "generated_by": "SOC Response Atlas by Basyrix", "tactics": [ "Execution" ], "platforms": [ "Linux", "Windows", "macOS", "IaaS", "Containers" ], "summary": "An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of [Phishing](https://attack.mitre.org/techniques/T1566)...", "soc_recommendation": "Investigate User Execution activity in the context of Execution: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.", "d3fend_mappings": [ { "id": "D3-RPA", "name": "Relay Pattern Analysis", "relationship": "detect", "practical_action": "Monitor for Relay Pattern Analysis indicators relevant to this technique.", "tooling": [ "Defender for Endpoint" ] }, { "id": "D3-FE", "name": "File Encryption", "relationship": "harden", "practical_action": "Apply File Encryption to reduce this technique's viability before an incident occurs.", "tooling": [ "Defender for Endpoint" ] }, { "id": "D3-FEV", "name": "File Eviction", "relationship": "evict", "practical_action": "Use File Eviction to remove the adversary's foothold once this technique is confirmed.", "tooling": [ "Defender for Endpoint" ] }, { "id": "D3-OTF", "name": "Outbound Traffic Filtering", "relationship": "isolate", "practical_action": "Apply Outbound Traffic Filtering to contain the blast radius once this technique is observed.", "tooling": [ "Sentinel", "Defender for Endpoint" ] } ], "investigation_steps": { "microsoft": [ "A binary in %TEMP% or %APPDATA%? → Almost certainly malicious", "An encoded PowerShell command? → Decode immediately (see GEN-EX-001)", "A legitimate binary with suspicious arguments?" ], "generic": [ "Confirm whether the observed user execution activity matches expected administrative or application behaviour.", "Identify the host, account, or resource where the activity occurred and its business criticality.", "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.", "Real detection reference: \"User Execution of Malicious File, ISO, or LNK\" -- Flags suspicious file types commonly used to bypass Mark of the Web after Microsoft blocked internet-sourced Office macros: mounted ISO/IMG execution, LNK files spawning LOLBins, and OneNote macro execution." ] }, "evidence_to_collect": [ "Host or resource affected", "Account or identity involved", "Timestamp of the activity", "Related process, file, or network artifact", "Any preceding or follow-on alerts" ], "response_actions": [ { "name": "Delete the malicious scheduled task via MDE Live Response or", "category": "Response", "risk": "Low", "automation_safe": false, "approval_required": true, "tool": "Defender for Endpoint", "notes": "Delete the malicious scheduled task via MDE Live Response or schtasks /delete" }, { "name": "Quarantine any binary the task would have executed", "category": "Response", "risk": "Low", "automation_safe": false, "approval_required": true, "tool": "See investigation guide" }, { "name": "Trace back to initial delivery — correlate with other alerts", "category": "Response", "risk": "Low", "automation_safe": false, "approval_required": true, "tool": "See investigation guide", "notes": "Trace back to initial delivery — correlate with other alerts on the device" }, { "name": "Check for additional persistence (registry run keys, service", "category": "Response", "risk": "Low", "automation_safe": true, "approval_required": false, "tool": "See investigation guide", "notes": "Check for additional persistence (registry run keys, services, WMI subscriptions)" } ], "queries": { "kql": [ { "name": "GEN-EX-003 — User Execution of Malicious File, ISO, or LNK", "description": "Flags suspicious file types commonly used to bypass Mark of the Web after Microsoft blocked internet-sourced Office macros: mounted ISO/IMG execution, LNK files spawning LOLBins, and OneNote macro execution. (Source: Bell Integration baseline detection library, mapped via sub-technique T1204.002.)", "query": "let ISOExecution = (\n DeviceProcessEvents\n | where TimeGenerated >= ago(5m)\n | where InitiatingProcessFolderPath has_any (\":\\\\\", \"volume{\")\n | where FolderPath has_any (\"AppData\", \"Temp\", \"Downloads\", \"Desktop\")\n | where InitiatingProcessFileName in~ (\n \"explorer.exe\", \"cmd.exe\", \"powershell.exe\", \"wscript.exe\",\n \"cscript.exe\", \"mshta.exe\", \"regsvr32.exe\", \"rundll32.exe\"\n )\n | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,\n InitiatingProcessFolderPath, SHA256\n | extend DetectionType = \"ISO_Execution\"\n);\nlet LNKExecution = (\n DeviceProcessEvents\n | where TimeGenerated >= ago(5m)\n | where InitiatingProcessFileName =~ \"explorer.exe\"\n | where FileName in~ (\n \"powershell.exe\", \"cmd.exe\", \"wscript.exe\", \"cscript.exe\",\n \"mshta.exe\", \"regsvr32.exe\", \"rundll32.exe\", \"certutil.exe\"\n )\n | where ProcessCommandLine has_any (\n \"-EncodedCommand\", \"-enc \", \"IEX\", \"DownloadString\",\n \"WebClient\", \"FromBase64String\", \"hidden\"\n )\n | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,\n InitiatingProcessFolderPath = \"\", SHA256\n | extend DetectionType = \"LNK_LOLBin\"\n);\nlet OneNoteExec = (\n DeviceProcessEvents\n | where TimeGenerated >= ago(5m)\n | where InitiatingProcessFileName =~ \"ONENOTE.EXE\"\n | where FileName in~ (\"cmd.exe\", \"powershell.exe\", \"wscript.exe\", \"cscript.exe\", \"mshta.exe\")\n | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,\n InitiatingProcessFolderPath = \"\", SHA256\n | extend DetectionType = \"OneNote_Macro\"\n);\nISOExecution\n| union LNKExecution\n| union OneNoteExec\n| extend timestamp = TimeGenerated,\n HostCustomEntity = DeviceName,\n AccountCustomEntity = AccountName\n| order by TimeGenerated desc" }, { "name": "0adab960-5565-4978-ba6d-044553e4acc4 — AWSCloudTrail - Successful API executed from a Tor exit node", "description": "Identifies successful AWS CloudTrail API activity originating from an IP address identified as a TOR exit node in the external TOR list hosted at https://firewalliplists.gypthecat.com/lists/kusto/kusto-tor-exit.csv.zip. The rule alerts only when CloudTrail indicates the request completed successfully with no ErrorCode and no ErrorMessage, and the source IP is present in the TOR exit node list. (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)", "query": "let TorNodes = (\nexternaldata (TorIP:string)\n[h@'https://firewalliplists.gypthecat.com/lists/kusto/kusto-tor-exit.csv.zip']\nwith (ignoreFirstRecord=true));\nAWSCloudTrail\n| where SourceIpAddress in (TorNodes) and isempty(ErrorCode) and isempty(ErrorMessage)\n| extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)\n| extend UserName = tostring(split(UserIdentityArn, '/')[-1])\n| extend AccountName = case( UserIdentityPrincipalid == \"Anonymous\", \"Anonymous\", isempty(UserIdentityUserName), UserName, UserIdentityUserName)\n| extend AccountName = iif(AccountName contains \"@\", tostring(split(AccountName, '@', 0)[0]), AccountName),\n AccountUPNSuffix = iif(AccountName contains \"@\", tostring(split(AccountName, '@', 1)[0]), \"\")\n| project TimeGenerated, SourceIpAddress, AccountName, AccountUPNSuffix, UserIdentityArn, UserIdentityUserName, UserIdentityPrincipalid, EventName, EventSource, AWSRegion, RecipientAccountId" }, { "name": "504257c1-81e2-4609-8d40-b395e62f11c7 — High severity malicious activity detected", "description": "Identifies high severity malicious activity in Azure Firewall IDPS logs. (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)", "query": "let TimeWindow = 90d; // How far back to look \nlet HitThreshold = 10; // Minimum hits to alert per SourceIp + Category\nlet MinSeverity = 1; // Set Minimum Severity\nlet EnableCategoryFilter = true; // Filter 1: use CategoriesOfInterest\nlet EnableDescriptionFilter = false; // Filter 2: use DescriptionsOfInterest\nlet EnableActionFilter = false; // Filter 3: use MatchActions\nlet CategoriesOfInterest = dynamic([\n \"Targeted Malicious Activity was Detected\",\n \"Exploit Kit Activity Detected\",\n \"Domain Observed Used for C2 Detected\",\n \"Successful Credential Theft Detected\",\n \"Malware Command and Control Activity Detected\",\n \"Executable code was detected\",\n \"A Network Trojan was detected\"\n]);\nlet DescriptionsOfInterest = dynamic([\n \"targeted-activity\",\n \"exploit-kit\",\n \"domain-c2\",\n \"credential-theft\",\n \"command-and-control\",\n \"shellcode-detect\",\n \"trojan-activity\"\n]);\nlet MatchActions = dynamic([\"Deny\", \"alert\"]);\nAZFWIdpsSignature\n| where TimeGenerated >= ago(TimeWindow)\n| where Severity >= MinSeverity\n// Filter 1: Category filter (optional)\n| where (EnableCategoryFilter == false) or (Category has_any (CategoriesOfInterest))\n// Filter 2: Description filter (optional)\n| where (EnableDescriptionFilter == false) or (Description has_any (DescriptionsOfInterest))\n// Filter 3: Action filter (optional)\n| where (EnableActionFilter == false) or (Action in~ (MatchActions))\n| summarize\n StartTime = min(TimeGenerated),\n EndTime = max(TimeGenerated),\n TotalHits = count(),\n MaxSeverity = max(Severity),\n Actions = make_set(Action, 5),\n Signatures = make_set(SignatureId, 20),\n Description = make_set(substring(tostring(Description), 0, 120), 3)\n by SourceIp, ThreatCategory = Category\n| where TotalHits >= HitThreshold\n| project\n StartTime,\n EndTime,\n SourceIp,\n ThreatCategory,\n TotalHits,\n MaxSeverity,\n Actions,\n Signatures,\n Description\n| order by MaxSeverity desc, TotalHits desc" } ], "spl": [], "esql": [ { "name": "28371aa1-14ed-46cf-ab5b-2fc7d1942278 — Potential Widespread Malware Infection Across Multiple Hosts", "description": "(ESQL) This rule uses alert data to determine when a malware signature is triggered in multiple hosts. Analysts can use this to prioritize triage and response, as this can potentially indicate a widespread malware infection. (Source: Elastic's official detection-rules repository (Elastic License v2).)", "query": "from logs-endpoint.alerts-*\n| where event.code in (\"malicious_file\", \"memory_signature\", \"shellcode_thread\") and rule.name is not null\n| keep host.id, rule.name, event.code\n| stats Esql.host_id_count_distinct = count_distinct(host.id) by rule.name, event.code\n| where Esql.host_id_count_distinct >= 3" }, { "name": "c5637438-e32d-4bb3-bc13-bd7932b3289f — Unusual Base64 Encoding/Decoding Activity", "description": "(ESQL) This rule leverages ESQL to detect unusual base64 encoding/decoding activity on Linux systems. Attackers may use base64 encoding/decoding to obfuscate data, such as command and control traffic or payloads, to evade detection by host- or network-based security controls. ESQL rules have limited fields available in its alert documents... (Source: Elastic's official detection-rules repository (Elastic License v2).)", "query": "from logs-endpoint.events.process-* metadata _id, _index, _version\n| mv_expand event.action \n| where\n host.os.type == \"linux\" and\n event.type == \"start\" and\n event.action == \"exec\" and (\n (\n process.name in (\"base64\", \"base64plain\", \"base64url\", \"base64mime\", \"base64pem\", \"base32\", \"base16\") and\n process.command_line like \"*-*d*\"\n ) or\n (\n process.name == \"openssl\" and\n process.args == \"enc\" and\n process.args in (\"-d\", \"-base64\", \"-a\")\n ) or\n (\n process.name like \"python*\" and (\n (\n process.args == \"base64\" and\n process.args in (\"-d\", \"-u\", \"-t\")\n ) or\n (\n process.args == \"-c\" and\n process.command_line like \"*base64*\" and\n process.command_line like \"*b64decode*\"\n )\n )\n ) or\n (\n process.name like \"perl*\" and\n process.command_line like \"*decode_base64*\"\n ) or\n (\n process.name like \"ruby*\" and\n process.args == \"-e\" and\n process.command_line like \"*Base64.decode64*\"\n )\n )\n| keep\n @timestamp,\n _id,\n _index,\n _version,\n host.os.type,\n event.type,\n event.action,\n process.name,\n process.args,\n process.command_line,\n process.parent.name,\n process.parent.command_line,\n agent.id,\n host.name,\n data_stream.dataset,\n data_stream.namespace\n| stats\n Esql.event_count = count(),\n Esql.process_parent_name_values = values(process.parent.name),\n Esql.process_parent_command_line_values = values(process.parent.command_line),\n Esql.agent_id_count_distinct = count_distinct(agent.id),\n Esql.host_name_values = values(host.name),\n Esql.agent_id_values = values(agent.id),\n Esql.data_stream_dataset_values = values(data_stream.dataset),\n Esql.data_stream_namespace_values = values(data_stream.namespace)\n by process.name, process.command_line\n| where\n Esql.agent_id_count_distinct == 1 and\n Esql.event_count < 15\n| sort Esql.event_count asc\n\n// Extract unique values to ECS fields for alerts exclusion\n| eval agent.id = mv_min(Esql.agent_id_values),\n host.name = mv_min(Esql.host_name_values)\n\n| keep agent.id, host.name, process.name, process.command_line, Esql.*" } ] }, "automation": { "safe": [ "Add recommendation as Sentinel incident comment.", "Run enrichment queries.", "Create ServiceNow SecOps task." ], "approval_required": [ "Contain or disable the affected host/account.", "Any change to production configuration." ] }, "escalation_criteria": [ "User Execution activity observed on a privileged account or critical system.", "Activity follows or precedes other suspicious behaviour in the same investigation.", "Automated triage cannot confidently rule out malicious intent." ], "false_positive_considerations": [ "Legitimate administrative or maintenance activity matching this pattern.", "Approved security testing or red team exercise.", "Known benign software producing similar telemetry." ], "confluence": { "title": "T1204 - User Execution Response Guidance", "labels": [ "mitre", "attack", "d3fend", "secops", "basyrix" ], "sections": [ "summary", "d3fend_mappings", "investigation_steps", "response_actions", "queries", "automation", "escalation_criteria", "false_positive_considerations" ] } }