TA0002 · EXECUTION
Exploitation for Client Execution
Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior.
Detect it with
Detecting software exploitation may be difficult depending on the tools available. Also look for behavior on the endpoint system that might indicate successful compromise, such as abnormal behavior of the browser or Office processes.
Why it matters on shift
Exploitation for Client Execution is one of the concrete ways adversaries achieve execution. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After execution, the next tactic is usually Persistence. Search your telemetry for the transition before closing the ticket.
Kill-chain context