User Execution
An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of [Phishing](https://attack.mitre.org/techniques/T1566). While [User Execution](https://attack.mitre.org/techniques/T1204) frequently occurs shortly after Initial Access it may occur at other ph...
BY SOURCE
PROCEDURES (56)
Auto-extracted: 7 detections for general monitoring
Auto-extracted: 4 detections for script execution monitoring
Auto-extracted: 4 detections for process creation monitoring
Auto-extracted: 4 detections for command and control
Auto-extracted: 3 detections for lateral
Auto-extracted: 2 detections for exfiltrat
Auto-extracted: 2 detections for anomal
Auto-extracted: 2 detections for download
Auto-extracted: 2 detections for ransomware
Auto-extracted: 2 detections for child process
Auto-extracted: 2 detections for base64
Auto-extracted: 2 detections for privilege
Auto-extracted: 2 detections for phish
Auto-extracted: 2 detections for email
Auto-extracted: 2 detections for masquerad
Auto-extracted: 2 detections for network connection monitoring
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for anomal
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for macro
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for email
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for encrypt
Auto-extracted: 1 detections for phish
Auto-extracted: 1 detections for phish
Auto-extracted: 1 detections for obfuscat
Auto-extracted: 1 detections for obfuscat
Auto-extracted: 1 detections for masquerad
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for ransomware
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for office
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for macro
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for macro
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for base64
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for office
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for email
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for anomal
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for container