T0863 · User Execution

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T0863 · User Execution · Sunturai

attack-patternics-attackT0863

User Execution

attack-pattern--2736b752-4ec5-4421-a230-8977dea7649c

Adversaries may rely on a targeted organizations user interaction for the execution of malicious code. User interaction may consist of installing applications, opening email attachments, or granting higher permissions to documents. Adversaries may embed malicious code or visual basic code into files such as Microsoft Word and Excel documents or software installers. (Citation: Booz Allen Hamilton) Execution of this code requires that the user enable scripting or write access within the document. Embedded code may not always be noticeable to the user especially in cases of trojanized software. (Citation: Daavid Hentunen, Antti Tikkanen June 2014) A Chinese spearphishing campaign running from December 9, 2011 through February 29, 2012 delivered malware through spearphishing attachments which required user action to achieve execution. (Citation: CISA AA21-201A Pipeline Intrusion July 2021)

Created: May 21, 2020, 5:43 PM UTC
Modified: Apr 15, 2025, 7:58 PM UTC

5 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Egress Defend - Dangerous Attachment Detected	Medium	Microsoft Sentinel analytics	Sep 4, 2026	MIT License
Dataverse - TI map URL to DataverseActivity	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Dataverse - Executable uploaded to SharePoint document management site	Low	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
KnowBe4 Defend - Dangerous Attachment Detected	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Match Cyware Intel Watchlist Items With Common Logs	Unknown	Microsoft Sentinel analytics	Aug 29, 2026	MIT License

Showing 5 of 5

Filter in the catalogue

External references

mitre-attackT0863Open reference

Booz Allen HamiltonOpen reference

Daavid Hentunen, Antti Tikkanen June 2014Open reference

CISA AA21-201A Pipeline Intrusion July 2021Open reference

Platforms

None

Kill chain phases

execution

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object