T1204.002 Malicious File — Attack Simulation

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Potentially Unwanted Applications (PUA)
windows automated powershell
Procedure 02f35d62-9fdc-4a97-b899-a5d9a876d295; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Maldoc choice flags command execution
windows automated powershell
Procedure 0330a5d2-a45a-4272-a9ee-e364411c4b18; elevation not declared required; cleanup not declared. Not executed or individually validated.
Simulate Click-Fix via Downloaded BAT File
windows automated powershell
Procedure 22386853-f68d-4b50-a362-de235127c443; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Mirror Blast Emulation
windows automated powershell
Procedure 24fd9719-7419-42dd-bce6-ab3463110b3c; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
ClickFix Campaign - Abuse RunMRU to Launch mshta via PowerShell
windows automated powershell
Procedure 3f3120f0-7e50-4be2-88ae-54c61230cb9f; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
OSTap Payload Download
windows automated command_prompt
Procedure 3f3af983-118a-4fa1-85d3-ba4daa739d80; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Excel 4 Macro
windows automated powershell
Procedure 4ea1fc97-8a46-4b4e-ba48-af43d2a98052; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Office Generic Payload Download
windows automated powershell
Procedure 5202ee05-c420-4148-bf5e-fd7f7d24850c; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
LNK Payload Download
windows automated powershell
Procedure 581d7521-9c4b-420e-9695-2aec5241167f; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
OSTap Style Macro Execution
windows automated powershell
Procedure 8bebc690-18c7-4549-bc98-210f7019efff; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Office launching .bat file from AppData
windows automated powershell
Procedure 9215ea92-1ded-41b7-9cd6-79f9a78397aa; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Headless Chrome code execution via VBA
windows automated powershell
Procedure a19ee671-ed98-4e9d-b19c-d1954a51585a; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
OSTAP JS version
windows automated powershell
Procedure add560ef-20d6-4011-a937-2c340f930911; elevation not declared required; cleanup not declared. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint onprem Linux macOS Windows execution isolated_authorized_lab procedure_review_required telemetry_configuration_required

can_simulate subtechnique source_mapped

Detection and collection

T1204.002 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.