T1204.002: Malicious File — MITRE ATT&CK Technique

Description

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.(Citation: Mandiant Trojanized Windows 10)

Adversaries may employ various forms of Masquerading and Obfuscated Files or Information to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.(Citation: Password Protected Word Docs)

While Malicious File frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing.

Platforms

LinuxmacOSWindows

Mitigations (3)

User TrainingM1017

Use user training as a way to bring awareness to common phishing and spearphishing techniques and how to raise suspicion for potentially malicious events.

Execution PreventionM1038

Application control may be able to prevent the running of executables masquerading as other files.

Behavior Prevention on EndpointM1040

On Windows 10, various Attack Surface Reduction (ASR) rules can be enabled to prevent the execution of potentially malicious executable files (such as those that have been downloaded and executed by Office applications/scripting interpreters/email clients or that do not meet specific prevalence, age, or trusted list criteria). Note: cloud-delivered protection must be enabled for certain rules. (Ci

Threat Groups (86)

ID	Group	Context
G0082	APT38	[APT38](https://attack.mitre.org/groups/G0082) has attempted to lure victims into enabling malicious macros within email attachments.(Citation: CISA ...
G0119	Indrik Spider	[Indrik Spider](https://attack.mitre.org/groups/G0119) has attempted to get users to click on a malicious zipped file.(Citation: Symantec WastedLocker...
G0066	Elderwood	[Elderwood](https://attack.mitre.org/groups/G0066) has leveraged multiple types of spearphishing in order to attempt to get a user to open attachments...
G1008	SideCopy	[SideCopy](https://attack.mitre.org/groups/G1008) has attempted to lure victims into clicking on malicious embedded archive files sent via spearphishi...
G0094	Kimsuky	[Kimsuky](https://attack.mitre.org/groups/G0094) has used spearphishing attachments to entice victims into opening malicious files, including LNK file...
G1011	EXOTIC LILY	[EXOTIC LILY](https://attack.mitre.org/groups/G1011) has gained execution through victims clicking on malicious LNK files contained within ISO files, ...
G0018	admin@338	[admin@338](https://attack.mitre.org/groups/G0018) has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphis...
G0040	Patchwork	[Patchwork](https://attack.mitre.org/groups/G0040) embedded a malicious macro in a Word document and lured the victim to click on an icon to execute t...
G0035	Dragonfly	[Dragonfly](https://attack.mitre.org/groups/G0035) has used various forms of spearphishing in attempts to get users to open malicious attachments.(Cit...
G0078	Gorgon Group	[Gorgon Group](https://attack.mitre.org/groups/G0078) attempted to get users to launch malicious Microsoft Office attachments delivered via spearphish...
G0045	menuPass	[menuPass](https://attack.mitre.org/groups/G0045) has attempted to get victims to open malicious files such as Windows Shortcuts (.lnk) and/or Microso...
G0050	APT32	[APT32](https://attack.mitre.org/groups/G0050) has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment.(Ci...
G0069	MuddyWater	[MuddyWater](https://attack.mitre.org/groups/G0069) has attempted to get users to open malicious PDF attachment and to enable macros and launch malici...
G0019	Naikon	[Naikon](https://attack.mitre.org/groups/G0019) has convinced victims to open malicious attachments to execute malware.(Citation: CheckPoint Naikon Ma...
G0037	FIN6	[FIN6](https://attack.mitre.org/groups/G0037) has used malicious documents to lure victims into allowing execution of PowerShell scripts.(Citation: Vi...
G0047	Gamaredon Group	[Gamaredon Group](https://attack.mitre.org/groups/G0047) has attempted to get users to click on Office attachments with malicious macros embedded.(Cit...
G0084	Gallmaker	[Gallmaker](https://attack.mitre.org/groups/G0084) sent victims a lure document with a warning that asked victims to “enable content” for execution.(C...
G1046	Storm-1811	[Storm-1811](https://attack.mitre.org/groups/G1046) has prompted users to execute downloaded software and payloads as the result of social engineering...
G0046	FIN7	[FIN7](https://attack.mitre.org/groups/G0046) lured victims to double-click on images in the attachments they sent which would then execute the hidden...
G0034	Sandworm Team	[Sandworm Team](https://attack.mitre.org/groups/G0034) has tricked unwitting recipients into clicking on spearphishing attachments and enabling malici...

Associated Software (98)

ID	Name	Type	Context
S0266	TrickBot	Malware	[TrickBot](https://attack.mitre.org/software/S0266) has attempted to get users to launch malicious documents to deliver its payload. (Citation: TrendM...
S0520	BLINDINGCAN	Malware	[BLINDINGCAN](https://attack.mitre.org/software/S0520) has lured victims into executing malicious macros embedded within Microsoft Office documents.(C...
S1100	Ninja	Malware	[Ninja](https://attack.mitre.org/software/S1100) has gained execution through victims opening malicious executable files embedded in zip archives.(Cit...
S1039	Bumblebee	Malware	[Bumblebee](https://attack.mitre.org/software/S1039) has relied upon a user opening an ISO file to enable execution of malicious shortcut files and DL...
S1075	KOPILUWAK	Malware	[KOPILUWAK](https://attack.mitre.org/software/S1075) has gained execution through malicious attachments.(Citation: Mandiant Suspected Turla Campaign F...
S0665	ThreatNeedle	Malware	[ThreatNeedle](https://attack.mitre.org/software/S0665) relies on a victim to click on a malicious document for initial execution.(Citation: Kaspersky...
S1229	Havoc	Malware	[Havoc](https://attack.mitre.org/software/S1229) has been executed by victims through the use of targeted lures and crafted decoy documents.(Citation:...
S0491	StrongPity	Malware	[StrongPity](https://attack.mitre.org/software/S0491) has been executed via compromised installation files for legitimate software including compressi...
S0453	Pony	Malware	[Pony](https://attack.mitre.org/software/S0453) has attempted to lure targets into downloading an attached executable (ZIP, RAR, or CAB archives) or d...
S9026	ROAMINGHOUSE	Malware	During [Operation AkaiRyū](https://attack.mitre.org/campaigns/C0060), [MirrorFace](https://attack.mitre.org/groups/G1054) used malicious files to drop...
S0622	AppleSeed	Malware	[AppleSeed](https://attack.mitre.org/software/S0622) can achieve execution through users running malicious file attachments distributed via email.(Cit...
S0198	NETWIRE	Malware	[NETWIRE](https://attack.mitre.org/software/S0198) has been executed through luring victims into opening malicious documents.(Citation: FireEye NETWIR...
S0606	Bad Rabbit	Malware	[Bad Rabbit](https://attack.mitre.org/software/S0606) has been executed through user installation of an executable disguised as a flash installer.(Cit...
S0634	EnvyScout	Malware	[EnvyScout](https://attack.mitre.org/software/S0634) has been executed through malicious files attached to e-mails.(Citation: MSTIC Nobelium Toolset M...
S1238	STATICPLUGIN	Malware	[STATICPLUGIN](https://attack.mitre.org/software/S1238) has required user execution to load subsequent malicious payloads.(Citation: Google Threat Int...
S0367	Emotet	Malware	[Emotet](https://attack.mitre.org/software/S0367) has relied upon users clicking on a malicious attachment delivered through spearphishing.(Citation: ...
S1065	Woody RAT	Malware	[Woody RAT](https://attack.mitre.org/software/S1065) has relied on users opening a malicious email attachment for execution.(Citation: MalwareBytes Wo...
S1030	Squirrelwaffle	Malware	[Squirrelwaffle](https://attack.mitre.org/software/S1030) has relied on users enabling malicious macros within Microsoft Excel and Word attachments.(C...
S1086	Snip3	Malware	[Snip3](https://attack.mitre.org/software/S1086) can gain execution through the download of visual basic files.(Citation: Morphisec Snip3 May 2021)(Ci...
S0433	Rifdoor	Malware	[Rifdoor](https://attack.mitre.org/software/S0433) has been executed from malicious Excel or Word documents containing macros.(Citation: Carbon Black ...

References

Frequently Asked Questions

What is T1204.002 (Malicious File)?

T1204.002 is a MITRE ATT&CK technique named 'Malicious File'. It belongs to the Execution tactic(s). An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This us...

How can T1204.002 be detected?

Detection of T1204.002 (Malicious File) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.

What mitigations exist for T1204.002?

There are 3 documented mitigations for T1204.002. Key mitigations include: User Training, Execution Prevention, Behavior Prevention on Endpoint.

Which threat groups use T1204.002?

Known threat groups using T1204.002 include: APT38, Indrik Spider, Elderwood, SideCopy, Kimsuky, EXOTIC LILY, admin@338, Patchwork.