Forensia CTI Core

About

An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution. Links may also lead users to download files that require execution via Malicious File.

Platforms: Linux, macOS, WindowsParent: T1204 User ExecutionMITRE ATT&CK ↗

Software

29 malware/tools implement this

NETWIREEmotetPLEADTSCookiePonyBackConfigHancitorJavaliMelcozGrandoreiroBazarGuLoaderAppleJeusKerrdownObliqueRATSpicyOmeletteSMOKEDHAMQakBotKOCTOPUSOutSteelSaint BotSquirrelwaffleBumblebeeSnip3SocGholishGootloaderLatrodectusQilinROAMINGHOUSE

Corpus indicators tagged with this technique

4,907 indicators in the corpus carry T1204.001.

Indicator	Type	Family	Sev	Src
1794369214b7f62e70a0485e61335c61	hash	—	80	3
09c121225fe254676a27c21943506714	hash	phishing	80	2
8c9b6542f73c5c7fe455b52f5101314407da4f65ff48e7ebf6896605e607c8d0	hash	—	80	3
66a3836b9a17771bce2161f6b73cbc2494a91e49d6aa30d2d53711e8d10de60d	hash	—	80	3
8e1624d110c090ff57d4b493a9107c66	hash	—	80	3
4fcfa88fffacbce30bbe2136753c9ab5a4c092940d2406fd9d44d5118e745b9d	hash	—	80	3
40b41979b317406f8abc601677a3b93aaf6ef8ab8ac188b8f383735e388f13b5	hash	—	80	3
4c0d9b802c075be79e9edb52d88f8dd72e6904f5c58267213745818470945c78	hash	phishing	80	2
bb10adac5b0124efedfe71102c1d5638135ec9e1cde8c8cb3353c5ed91bb9f81	hash	phishing	80	2
d3ebce2f05fe91a8260e87fd11a6ea17c156703d081b3f91d9bbe5fd6aeedc10	hash	phishing	80	2
9d0a55c545c4147956db2c2667c4ed931a2875309147548b1dfdd216228f5f73	hash	—	80	3
a648db354820ea4d02940cb1702b35974513b7aae83f6dffaacaac4ba31f9295	hash	—	80	3
0857148fb0bc4aa7adf967ede2307bdb4fc427065d5b6a6db132688a5a8e1eb8	hash	—	80	3
314f4b59535d1b783e1c20c2be00f9e30f8ed27b2e21fad06a73b47ea43279ef	hash	—	80	3
3e7066e44132e64360a30974b6ea3671	hash	—	80	3
e5e43b0830369c39fab45363486da4d21a98c5097ea262c9816997f11c73c1c4	hash	phishing	80	2
2a350525ba72ffc9fe45a05a423833d5	hash	phishing	80	2
cd4a51037bf58733c0cb24b273951dd3fcea45a2aaeb8b30a3c625e183c4c0c7	hash	phishing	80	2
adcd15f3d6b87f84d106ea426fa824fd20c9d64f6d199ce92580884290785f30	sha256	phishing	80	1
7b7981c99d59595fe15377df84695bb72ce0b85560a3935f930657b2d162e5ef	sha256	phishing	80	1
808e7154b7af2bc7a4b28d577297c55f77221c355191cbe00f9f1810b6d4a619	hash	phishing	80	2
d7d2f0ee187549f3f4a114d716be12521fbf62d6d26e2ac23d2a32d521d08fd8	sha256	phishing	80	1
d5e9288693aa745dc89368deac677e7ea1ec81e663283af30838cdae189b7a7e	hash	phishing	80	2
0ffb16209def5500ff4380d9e8093437	hash	—	80	3
2d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d	hash	—	80	3
584a9448dda46bd590d7a2f86228100d2ae6e0d6d990c1a4459ed5ee28e07ae8	hash	—	80	3
483a36fb9e4aef9704aa1e4edfb88c492dfe4140	hash	—	80	3
7b2c661cfb69e9c75df90d5102647bb014c28ad5	hash	—	80	3
3119cf37b8267db8a2dcd11d9a83d5237d7ef1e42388e7c9afa2831b91da8a2d	hash	—	80	3
33760b2aa86deea5805e647197c34ef5	hash	phishing	80	2

Showing the top 30 by severity of 4,907.