Execution

WMI used to execute commands locally or on remote hosts without dropping a new binary.

Detect it with
WmiPrvSE.exe as a parent of cmd or powershell; WMI event subscriptions created outside change windows.

schtasks, cron, at, and systemd timers used both to execute now and to survive a reboot.

Detect it with
Event ID 4698 (task created); new cron entries; tasks whose action points at a user-writable path.

PowerShell, cmd, bash, Python, JavaScript, and Visual Basic used to run adversary commands.

Detect it with
Encoded PowerShell (-enc, -w hidden), Office applications spawning interpreters, script block logging (Event ID 4104).

Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network.

Detect it with
Detection methods will vary depending on the type of third-party software or system and how it is typically used.

Adversaries may interact with the native OS application programming interface (API) to execute behaviors.

Detect it with
Monitoring API calls may generate a significant amount of data and may not be useful for defense unless collected under specific circumstances, since benign use of API functions are common and may be difficult to distinguish from malicious behavior.

Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API).

Detect it with
Monitoring DLL module loads may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances, since benign use of Windows modules load functions are common and may be difficult to distinguish from malicious…

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior.

Detect it with
Detecting software exploitation may be difficult depending on the tools available. Also look for behavior on the endpoint system that might indicate successful compromise, such as abnormal behavior of the browser or Office processes.

The user opens the attachment, mounts the ISO, runs the installer, or pastes the ClickFix command.

Detect it with
Process trees rooted in a mail client or browser download directory; execution from temp, Downloads, or a mounted image.

Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution.

Detect it with
Monitor for strings in files/commands, loaded DLLs/libraries, or spawned processes that are associated with abuse of IPC mechanisms.

Creating or abusing services (including PsExec-style service installs) to execute payloads as SYSTEM.

Detect it with
Event ID 7045 (service installed) with a random-looking service name or a binary path in ADMIN$.

Adversaries may abuse a container administration service to execute commands within a container.

Detect it with
Container administration service activities and executed commands can be captured through logging of process execution with command-line arguments on the container and the underlying host.

Adversaries may deploy a container into an environment to facilitate execution or evade defenses.

Detect it with
Monitor for suspicious or unknown container images and pods in your environment. Deploy logging agents on Kubernetes nodes and retrieve logs from sidecar proxies for application pods to detect malicious activity at the cluster level.

Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments.

Detect it with
No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may abuse cloud management services to execute commands within virtual machines.

Detect it with
No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of action on behalf of the user, such as launching the command interpreter using keyboard shortcuts, typing an inline script to be executed, or interacting…

Detect it with
No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may abuse ESXi administration services to execute commands on guest machines hosted within an ESXi virtual environment.

Detect it with
No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.