// MITRE ATT&CK
T1204.002 · Malicious File
Sub-technique of T1204 · User Execution.
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://a...
How to detect & mitigate it
Detecting Malicious File starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.
Related techniques
T1053.005
Scheduled Task T1047
Windows Management Instrumentation T1129
Shared Modules T1059.007
JavaScript T1053.007
Container Orchestration Job T1559.002
Dynamic Data Exchange T1053.003
Cron T1559.001
Component Object Model
Scheduled Task T1047
Windows Management Instrumentation T1129
Shared Modules T1059.007
JavaScript T1053.007
Container Orchestration Job T1559.002
Dynamic Data Exchange T1053.003
Cron T1559.001
Component Object Model
Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.