Automation · API / MCP 中文

Technique note · T1204.001

Malicious Link

An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution. Links may also lead users to download files that require execution via Malicious File.

ATT&CK T1204.001 platforms — Status Active Version 20.1

An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution. Links may also lead users to download files that require execution via Malicious File.

Groups using this technique

GroupNameCountry
grp_g0134Transparent TribePakistan
grp_g0103Mofang—
grp_g0095Machete—
grp_g1011EXOTIC LILY—
grp_g1018TA2541—
grp_g1034Daggerfly—
grp_g1037TA577—
grp_g0021Molerats—
grp_g1038TA578—
grp_g0085FIN4—
grp_g0120Evilnum—
grp_g0090WIRTE—
grp_g1014LuminousMothChina
grp_g1020Mustard Tempest—
grp_g1031Saint BearRussia
grp_g0128ZIRCONIUM—
grp_g1035Winter Vivern—
grp_g0129Mustang PandaChina
grp_g0064APT33Iran
grp_g0142Confucius—
grp_g0112Windshift—
grp_g0066ElderwoodChina
grp_g0080Cobalt Group—
grp_g1039RedCurlRussia
grp_g0102Wizard SpiderRussia
grp_g0049OilRigIran
grp_g1052Contagious Interview—
grp_g0069MuddyWater—
grp_g0061FIN8—
grp_g0082APT38DPRK
grp_g1059NIMBUS MANTICORE—
grp_g0065LeviathanChina
grp_g0046FIN7—
grp_g0087APT39—
grp_g0010TurlaRussia
grp_g0099APT-C-36—
grp_g0047Gamaredon GroupRussia
grp_g0022APT3China
grp_g0092TA505—
grp_g0094KimsukyDPRK
grp_g0059Magic HoundIran
grp_g0098BlackTechChina
grp_g0140LazyScripter—
grp_g1006Earth LuscaChina
grp_g0007APT28Russia
grp_g0016APT29Russia
grp_g0040Patchwork—
grp_g0121SidewinderIndia
grp_g0034Sandworm TeamRussia
grp_g0050APT32Vietnam

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.