T1204
User Execution
Adversaries may rely upon specific actions by a user in order to gain execution. Users may be tricked into opening malicious files or clicking malicious links.
ATT&CK / Execution
Defense strategies
- Security awareness training
- Email and web filtering
- Disable macros by default
- Application sandboxing
Detection methods
- Monitor process creation from Office apps
- Track downloads and executed files
- Correlate email activity with execution