T1204.001 · execution · 47 actors · 0 correlated reports

Malicious Link

An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution. Links may also lead users to download files that require execution via Malicious File.

Open detection, hunting, mitigation, and evidence workspace

Detection logic

Inspect network traffic for indications that a user visited a malicious site, such as links included in phishing campaigns directed at your organization. Anti-virus can potentially detect malicious documents and files that are downloaded from a link and executed on the user's computer.

Observed actors

Correlated CTI and IR reports

Continue the investigation

Interactive ThreatMapper ThreatMapper documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas ITDR Handbook 1200km Medium research