User-Initiated Execution

Overview

User-Initiated Execution is a technique where adversaries rely on a legitimate user to trigger the execution of malicious code or commands. This approach leverages user actions to bypass automated defenses and gain foothold or execute payloads during various stages of an attack lifecycle.

Attack Objective

• Enable execution of attacker-controlled code or commands
• Supports multiple stages including Initial Access, Execution, Persistence, and Privilege Escalation
• Advances attacker control by leveraging user interaction to evade automated detection and facilitate payload delivery

How the Technique Works

Adversaries craft content or deliver payloads that require a user to perform an action such as opening a file, clicking a link, or running a program. This user action initiates the execution of malicious code within the context of the user’s environment, often bypassing automated execution prevention mechanisms.

Common Methods & Variations

• Execution via malicious email attachments, documents with embedded macros, or links to malicious websites
• Variants include on-premises endpoint execution, cloud-based application triggers, and identity-based actions such as OAuth consent or multi-factor authentication bypass
• Use of living-off-the-land binaries and scripts (LOLBins/LOLScripts) to blend with legitimate user activity versus deployment of custom malware

Indicators of Compromise (IOCs)

• Unusual user-initiated process launches, especially of scripting engines or system utilities
• Logs showing user interaction with suspicious files, links, or applications
• Network connections initiated by user processes to uncommon destinations
• Cloud or identity logs indicating anomalous user consent or application authorization events

Detection Strategies

• Telemetry from endpoint process creation, user activity logs, and application usage monitoring
• Behavioral detection focusing on anomalous user actions and process chains rather than static signatures
• Correlation of user interaction events with subsequent suspicious execution or network activity

Mitigation & Prevention

• Enforce application whitelisting and restrict execution of unauthorized scripts or binaries
• Implement user training to recognize phishing and social engineering attempts
• Apply least privilege principles and multi-factor authentication to reduce impact of compromised user credentials
• Use email and web filtering to block malicious attachments and links

Response Considerations

• Immediately isolate affected endpoints to prevent further execution
• Investigate user activity logs to determine the scope and vector of execution
• Review and revoke any unauthorized permissions or tokens granted during the incident
• Apply patches and hardening measures to prevent recurrence

Related Techniques

• Phishing for Initial Access
• Execution through Command-Line Interface or Scripting
• Persistence via User Execution
• Privilege Escalation following user-initiated code execution

Mapping & References

• MITRE ATT&CK: Execution – User Execution (T1204)
• Public advisories on social engineering and phishing campaigns
• Incident reports detailing user-initiated malware execution vectors