MITRE ATT&CK - Técnica

T1204: User Execution

User Execution (T1204) é uma técnica catalogada no MITRE ATT&CK Enterprise usada como referência para mapear comportamento adversário em auditorias de segurança.

Técnica T1204 Enterprise ATT&CK

Contexto para AppSec

Em uma auditoria de AppSec, User Execution deve ser usada para revisar caminhos em que código, configuração, dependências ou infraestrutura podem viabilizar o comportamento descrito pela MITRE. No ATT&CK, ela aparece em Execution. As plataformas mapeadas pela MITRE incluem Linux, Windows, macOS, IaaS e Containers. No Vigly, esse contexto ajuda a conectar evidências do repositório com priorização e remediação.

Tática/fase Execution
Plataformas MITRE Linux, Windows, macOS, IaaS, Containers

Descrição oficial original do MITRE ATT&CK

An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. Adversaries may also deceive users into performing actions such as: * Enabling Remote Access Tools, allowing direct control of the system to the adversary

  • Running malicious JavaScript in their browser, allowing adversaries to Steal Web Session Cookies
  • Downloading and executing malware for User Execution
  • Coerceing users to copy, paste, and execute malicious code manually For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Tools.
Ver fonte oficial no MITRE ATT&CK

Como o Vigly audita a técnica User Execution automaticamente na sua pipeline

O Vigly cruza sinais de SAST, modelagem de ameaças, regras de negócio e evidências do repositório para priorizar riscos reais antes que eles cheguem à produção.

Conhecer a plataforma