Description
An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution. Links may also lead users to download files that require execution via Malicious File.
Platforms
Mitigations (3)
Network Intrusion PreventionM1031
If a link is being visited by a user, network intrusion prevention systems and systems designed to scan and remove malicious downloads can be used to block activity.
Restrict Web-Based ContentM1021
If a link is being visited by a user, block unknown or unused files in transit by default that should not be downloaded or by policy from suspicious sites as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl, etc. Some download scanning devices can open and analyze compressed and encrypted formats, such as zip and rar that may be used to conceal malicious files.
User TrainingM1017
Use user training as a way to bring awareness to common phishing and spearphishing techniques and how to raise suspicion for potentially malicious events.
Threat Groups (49)
| ID | Group | Context |
|---|---|---|
| G0082 | APT38 | [APT38](https://attack.mitre.org/groups/G0082) has used links to execute a malicious Visual Basic script.(Citation: 1 - appv) |
| G0066 | Elderwood | [Elderwood](https://attack.mitre.org/groups/G0066) has leveraged multiple types of spearphishing in order to attempt to get a user to open links.(Cita... |
| G0022 | APT3 | [APT3](https://attack.mitre.org/groups/G0022) has lured victims into clicking malicious links delivered through spearphishing.(Citation: FireEye Cland... |
| G1020 | Mustard Tempest | [Mustard Tempest](https://attack.mitre.org/groups/G1020) has lured users into downloading malware through malicious links in fake advertisements and s... |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has lured victims into clicking malicious links.(Citation: KISA Operation Muzabi) |
| G1011 | EXOTIC LILY | [EXOTIC LILY](https://attack.mitre.org/groups/G1011) has used malicious links to lure users into executing malicious payloads.(Citation: Google EXOTIC... |
| G1037 | TA577 | [TA577](https://attack.mitre.org/groups/G1037) has lured users into executing malicious JavaScript files by sending malicious links via email.(Citatio... |
| G0040 | Patchwork | [Patchwork](https://attack.mitre.org/groups/G0040) has used spearphishing with links to try to get users to click, download and open malicious files.(... |
| G0120 | Evilnum | [Evilnum](https://attack.mitre.org/groups/G0120) has sent spearphishing emails designed to trick the recipient into opening malicious shortcut links w... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050) has lured targets to download a Cobalt Strike beacon by including a malicious link within spearphishing... |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has distributed URLs in phishing e-mails that link to lure documents.(Citation: Anomali Static Kit... |
| G0047 | Gamaredon Group | [Gamaredon Group](https://attack.mitre.org/groups/G0047) has attempted to get users to click on a link pointing to a malicious HTML file leading to fo... |
| G0046 | FIN7 | [FIN7](https://attack.mitre.org/groups/G0046) has used malicious links to lure victims into downloading malware.(Citation: CrowdStrike Carbon Spider A... |
| G0034 | Sandworm Team | [Sandworm Team](https://attack.mitre.org/groups/G0034) has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to... |
| G0095 | Machete | [Machete](https://attack.mitre.org/groups/G0095) has has relied on users opening malicious links delivered through spearphishing to execute malware.(C... |
| G0121 | Sidewinder | [Sidewinder](https://attack.mitre.org/groups/G0121) has lured targets to click on malicious links to gain execution in the target environment.(Citatio... |
| G0129 | Mustang Panda | [Mustang Panda](https://attack.mitre.org/groups/G0129) has sent malicious links including links directing victims to a Google Drive folder.(Citation: ... |
| G0128 | ZIRCONIUM | [ZIRCONIUM](https://attack.mitre.org/groups/G0128) has used malicious links in e-mails to lure victims into downloading malware.(Citation: Google Elec... |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) has sent spearphishing emails in an attempt to lure users to click on a malicious link.(Citation: FireE... |
| G1052 | Contagious Interview | [Contagious Interview](https://attack.mitre.org/groups/G1052) has lured victims to click on a malicious link that led to download of a malicious paylo... |
Associated Software (30)
| ID | Name | Type | Context |
|---|---|---|---|
| S1039 | Bumblebee | Malware | [Bumblebee](https://attack.mitre.org/software/S1039) has relied upon a user downloading a file from a OneDrive link for execution.(Citation: Proofpoin... |
| S0453 | Pony | Malware | [Pony](https://attack.mitre.org/software/S0453) has attempted to lure targets into clicking links in spoofed emails from legitimate banks.(Citation: M... |
| S9026 | ROAMINGHOUSE | Malware | [ROAMINGHOUSE](https://attack.mitre.org/software/S9026) has been executed through luring victims into clicking links to download malicious ZIP files.(... |
| S0198 | NETWIRE | Malware | [NETWIRE](https://attack.mitre.org/software/S0198) has been executed through convincing victims into clicking malicious links.(Citation: FireEye NETWI... |
| S0367 | Emotet | Malware | [Emotet](https://attack.mitre.org/software/S0367) has relied upon users clicking on a malicious link delivered through spearphishing.(Citation: Trend ... |
| S1138 | Gootloader | Malware | [Gootloader](https://attack.mitre.org/software/S1138) has been executed through malicious links presented to users as internet search results.(Citatio... |
| S1030 | Squirrelwaffle | Malware | [Squirrelwaffle](https://attack.mitre.org/software/S1030) has relied on victims to click on a malicious link send via phishing campaigns.(Citation: ZS... |
| S1086 | Snip3 | Malware | [Snip3](https://attack.mitre.org/software/S1086) has been executed through luring victims into clicking malicious links.(Citation: Telefonica Snip3 De... |
| S0561 | GuLoader | Malware | [GuLoader](https://attack.mitre.org/software/S0561) has relied upon users clicking on links to malicious documents.(Citation: Unit 42 NETWIRE April 20... |
| S0644 | ObliqueRAT | Malware | [ObliqueRAT](https://attack.mitre.org/software/S0644) has gained execution on targeted systems through luring users to click on links to malicious URL... |
| S1124 | SocGholish | Malware | [SocGholish](https://attack.mitre.org/software/S1124) has lured victims into interacting with malicious links on compromised websites for execution.(C... |
| S0646 | SpicyOmelette | Malware | [SpicyOmelette](https://attack.mitre.org/software/S0646) has been executed through malicious links within spearphishing emails.(Citation: Secureworks ... |
| S0528 | Javali | Malware | [Javali](https://attack.mitre.org/software/S0528) has achieved execution through victims clicking links to malicious websites.(Citation: Securelist Br... |
| S0436 | TSCookie | Malware | [TSCookie](https://attack.mitre.org/software/S0436) has been executed via malicious links embedded in e-mails spoofing the Ministries of Education, Cu... |
| S1160 | Latrodectus | Malware | [Latrodectus](https://attack.mitre.org/software/S1160) has been executed through malicious links distributed in email campaigns.(Citation: Latrodectus... |
| S1018 | Saint Bot | Malware | [Saint Bot](https://attack.mitre.org/software/S1018) has relied on users to click on a malicious link delivered via a spearphishing.(Citation: Palo Al... |
| S0649 | SMOKEDHAM | Malware | [SMOKEDHAM](https://attack.mitre.org/software/S0649) has relied upon users clicking on a malicious link delivered through phishing.(Citation: FireEye ... |
| S0585 | Kerrdown | Malware | [Kerrdown](https://attack.mitre.org/software/S0585) has gained execution through victims opening malicious links.(Citation: Amnesty Intl. Ocean Lotus ... |
| S0531 | Grandoreiro | Malware | [Grandoreiro](https://attack.mitre.org/software/S0531) has used malicious links to gain execution on victim machines.(Citation: IBM Grandoreiro April ... |
| S0534 | Bazar | Malware | [Bazar](https://attack.mitre.org/software/S0534) can gain execution after a user clicks on a malicious link to decoy landing pages hosted on Google Do... |
Frequently Asked Questions
What is T1204.001 (Malicious Link)?
T1204.001 is a MITRE ATT&CK technique named 'Malicious Link'. It belongs to the Execution tactic(s). An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. Th...
How can T1204.001 be detected?
Detection of T1204.001 (Malicious Link) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1204.001?
There are 3 documented mitigations for T1204.001. Key mitigations include: Network Intrusion Prevention, Restrict Web-Based Content, User Training.
Which threat groups use T1204.001?
Known threat groups using T1204.001 include: APT38, Elderwood, APT3, Mustard Tempest, Kimsuky, EXOTIC LILY, TA577, Patchwork.