User Execution

What is User Execution?

“User Execution is documented as technique T1204 in MITRE ATT&CK® v19.1 under the Execution tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify User Execution activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor Office application processes for macro execution events, particularly when macros access the internet, spawn child processes, or write executable files to disk locations commonly used for malware staging.

2. 2

   Track file execution events for files downloaded from the internet or received via email, paying attention to the Zone.Identifier alternate data stream which indicates files sourced from external locations.

3. 3

   Correlate user-initiated file execution with subsequent network connections, registry modifications, or process creation to identify execution chains consistent with malware deployment following social engineering.

4. 4

   Alert on execution of files from temporary directories, user profile download folders, or uncommon paths such as AppData or Temp, which are frequently used as staging locations for malware delivered through user execution.

5. 5

   Monitor for the extraction and execution of files from password-protected archives, as attackers use password protection to bypass email gateway scanning and deliver malicious executables to end users.

Example Alerts

These realistic alert examples show what User Execution looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect User Execution?

Detection centers on XDR, SIEM telemetry for the execution phase of the attack. Monitor Office application processes for macro execution events, particularly when macros access the internet, spawn child processes, or write executable files to disk locations commonly used for malware staging. Track file execution events for files downloaded from the internet or received via email, paying attention to the Zone.Identifier alternate data stream which indicates files sourced from external locations.

What does a User Execution alert look like?

A representative XDR detection is "Malicious Office Macro Enabled by User" (critical severity): User enabled macros in a Word document received via email claiming to be an invoice from a vendor. Macro executed PowerShell to download and run a payload from hxxps://cdn-updates.net/update.exe. The executable was immediately flagged by behavioral analysis as exhibiting ransomware-like encryption behavior against user documents.

Which tools detect User Execution, and how can I practice?

User Execution (T1204) is best surfaced with XDR, SIEM telemetry, which exposes the execution signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.