T1204.001 Malicious Link — Attack Simulation

An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client…

Technique description

No compatible procedure was found in the pinned Atomic index. This is a support gap, not a finding of technical impossibility.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

No compatible documented candidate in the pinned snapshot. This is a support gap, not technical impossibility.

Connected ecosystem references

Linked tags

cannot_simulate_yet subtechnique source_mapped

Detection and collection

T1204.001 detection workspace

Attack tools

No reviewed association in this snapshot.

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.