1200KM / tag
execution — tactic tag
79 related reference pages for tactic: execution.
Meaning and evidence boundary
Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.
Related pages
- T0807 Command-Line Interface · simulation
- T0821 Modify Controller Tasking · simulation
- T0823 Graphical User Interface · simulation
- T0834 Native API · simulation
- T0853 Scripting · simulation
- T0858 Change Operating Mode · simulation
- T0863 User Execution · simulation
- T0871 Execution through API · simulation
- T0874 Hooking · simulation
- T0895 Autorun Image · simulation
- T1047 Windows Management Instrumentation · simulation
- T1053 Scheduled Task/Job · simulation
- T1053.002 At · simulation
- T1053.003 Cron · simulation
- T1053.005 Scheduled Task · simulation
- T1053.006 Systemd Timers · simulation
- T1053.007 Container Orchestration Job · simulation
- T1059 Command and Scripting Interpreter · simulation
- T1059.001 PowerShell · simulation
- T1059.002 AppleScript · simulation
- T1059.003 Windows Command Shell · simulation
- T1059.004 Unix Shell · simulation
- T1059.005 Visual Basic · simulation
- T1059.006 Python · simulation
- T1059.007 JavaScript · simulation
- T1059.008 Network Device CLI · simulation
- T1059.009 Cloud API · simulation
- T1059.010 AutoHotKey & AutoIT · simulation
- T1059.011 Lua · simulation
- T1059.012 Hypervisor CLI · simulation
- T1059.013 Container CLI/API · simulation
- T1072 Software Deployment Tools · simulation
- T1106 Native API · simulation
- T1127 Trusted Developer Utilities Proxy Execution · simulation
- T1127.001 MSBuild · simulation
- T1127.002 ClickOnce · simulation
- T1127.003 JamPlus · simulation
- T1129 Shared Modules · simulation
- T1197 BITS Jobs · simulation
- T1203 Exploitation for Client Execution · simulation
- T1204 User Execution · simulation
- T1204.001 Malicious Link · simulation
- T1204.002 Malicious File · simulation
- T1204.003 Malicious Image · simulation
- T1204.004 Malicious Copy and Paste · simulation
- T1204.005 Malicious Library · simulation
- T1559 Inter-Process Communication · simulation
- T1559.001 Component Object Model · simulation
- T1559.002 Dynamic Data Exchange · simulation
- T1559.003 XPC Services · simulation
- T1569 System Services · simulation
- T1569.001 Launchctl · simulation
- T1569.002 Service Execution · simulation
- T1569.003 Systemctl · simulation
- T1574 Hijack Execution Flow · simulation
- T1574.001 DLL · simulation
- T1574.004 Dylib Hijacking · simulation
- T1574.005 Executable Installer File Permissions Weakness · simulation
- T1574.006 Dynamic Linker Hijacking · simulation
- T1574.007 Path Interception by PATH Environment Variable · simulation
- T1574.008 Path Interception by Search Order Hijacking · simulation
- T1574.009 Path Interception by Unquoted Path · simulation
- T1574.010 Services File Permissions Weakness · simulation
- T1574.011 Services Registry Permissions Weakness · simulation
- T1574.012 COR_PROFILER · simulation
- T1574.013 KernelCallbackTable · simulation
- T1574.014 AppDomainManager · simulation
- T1575 Native API · simulation
- T1603 Scheduled Task/Job · simulation
- T1609 Container Administration Command · simulation
- T1610 Deploy Container · simulation
- T1623 Command and Scripting Interpreter · simulation
- T1623.001 Unix Shell · simulation
- T1648 Serverless Execution · simulation
- T1651 Cloud Administration Command · simulation
- T1658 Exploitation for Client Execution · simulation
- T1674 Input Injection · simulation
- T1675 ESXi Administration Command · simulation
- T1677 Poisoned Pipeline Execution · simulation
Connected ecosystem references
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.