T1203 Exploitation for Client Execution — ATT&CK Technique
Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility. Several types exist: ### Browser-based Exploitation Web browsers are a common target through Drive-by Compromise and Spearphishing Link. Endpoint systems may be compromised through normal web browsing or from certain users being targeted by links in spearphishing emails to adversary controlled sites used to exploit the web browser. These often do not require an action by the user for the exploit to be executed. ### Office Applications Common office and productivity applications such as Microsoft Office are also targeted through Phishing. Malicious files will be transmitted directly as attachments or through links to download them. These require the user to open the document or file for the exploit to run. ### Common Third-party Applications Other applications that are commonly seen or are part of the software deployed in a target network may also be used for exploitation. Applications such as Adobe Reader and Flash, which are common in enterprise environments, have been routinely targeted by adversaries attempting to gain access to systems. Depending on the software and nature of the vulnerability, some may be exploited in the browser or require the user to open a file. For instance, some Flash exploits have been delivered as objects within Microsoft Office documents.
Detection coverage (47)
- Exploit for CVE-2017-0261 medium
- Droppers Exploiting CVE-2017-11882 critical
- Exploit for CVE-2017-8759 critical
- Potential CVE-2021-26857 Exploitation Attempt high
- OMIGOD SCX RunAsProvider ExecuteScript high
- CVE-2021-26858 Exchange Exploitation high
- OMIGOD HTTP No Authentication RCE - CVE-2021-38647 high
- CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum critical
- CVE-2021-31979 CVE-2021-33771 Exploits critical
- CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process high
- Potential Exploitation of CVE-2025-4427/4428 Ivanti EPMM Pre-Auth RCE high
- Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process high
- Exploitation Activity of CVE-2025-59287 - WSUS Deserialization high
- Shai-Hulud Malicious Bun Execution - Linux high
- Shai-Hulud Malicious Bun Execution high
- Dfsvc.EXE Initiated Network Connection Over Uncommon Port high
- Dfsvc.EXE Network Connection To Non-Local IPs medium
- Suspicious Download and Execute Pattern via Curl/Wget high
- OMIGOD SCX RunAsProvider ExecuteShellCommand high
- Suspicious Invocation of Shell via Rsync high
- Download From Suspicious TLD - Blacklist low
- Suspicious Browser Child Process - MacOS medium
- Download From Suspicious TLD - Whitelist low
- Audit CVE Event critical
- Office Application Initiated Network Connection To Non-Local IP medium
- Network Connection Initiated By Eqnedt32.EXE high
- Suspicious ArcSOC.exe Child Process high
- Suspicious HWP Sub Processes high
- Java Running with Remote Debugging medium
- Potentially Suspicious Child Process of KeyScrambler.exe medium
- Suspicious Spool Service Child Process high
- Potentially Suspicious Child Process Of WinRAR.EXE medium
- Antivirus - APT Malware Signature critical
- Antivirus - Exploitation Framework Signature critical
- Antivirus - Remote Access Tools Signature critical
- Sunburst Correlation DLL and Network Event
- Windows MSC EvilTwin Directory Path Manipulation
- Windows Remote Image Load
- Cisco Secure Firewall - Malware File Downloaded
- Detect Windows DNS SIGRed via Zeek
- Cisco Secure Firewall - Possibly Compromised Host
- Cisco Secure Firewall - Binary File Type Download
- Cisco Secure Firewall - Blocked Connection
- Cisco Secure Firewall - High Priority Intrusion Classification
- Cisco Secure Firewall - Citrix NetScaler Memory Overread Attempt
- Cisco Secure Firewall - Repeated Blocked Connections
- Detect Windows DNS SIGRed via Splunk Stream
Malware using this technique
- Agent Tesla
- Bankshot
- VersaMem
- XLoader
- EvilBunny
- Xbash
- SUPERNOVA
- Ramsay
- SpeakUp
- HAWKBALL
- DealersChoice
- Woody RAT
- Cobalt Strike
- InvisiMole
Threat actors using this technique
- Sidewinder
- Saint Bear
- APT28
- APT27
- Sandworm Team
- Dragonfly
- Andariel
- The White Company
- EXOTIC LILY
- Lazarus Group
- APT29
- BlackTech
- Confucius
- Patchwork
- APT12
- Axiom
- Higaisa
- Cobalt Group
- APT40
- APT37
- TA459
- Mustang Panda
- UNC3886
- Darkhotel
- APT32
- APT3
- BRONZE BUTLER
- Sea Turtle
- Transparent Tribe
- Tropic Trooper
- Tonto Team
- Aoqin Dragon
- Inception
- APT41
- Ember Bear
- BITTER
- Elderwood
- OilRig
- admin@338
- APT33
- MuddyWater