T1203 — Exploitation for Client Execution

Tactic: Execution · Platforms: Linux, macOS, Windows

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the…

Sigma detection rules (3)

T1203 Exploitation for Client Execution

title: T1203 Exploitation for Client Execution
id: 53634a9a-c969-4dd2-8480-e972e821e3c7
description: 'Detects a client-facing application (browser, Office, PDF reader, mail client) directly writing an executable or script payload to a temp or downloads path, consistent with successful exploitation for client execution dropping a follow-on payload. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, HighRiskChildren, UserPaths, AllowedPlugins, EgressAllowlist.'
references:
  - https://attack.mitre.org/techniques/T1203
author: Shahrukh Khan
date: 2026-02-20
license: MIT
tags:
  - attack.execution
  - attack.t1203

logsource:
  category: file_event
  product: windows

detection:
  selection_client_image:
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\iexplore.exe'
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\POWERPNT.EXE'
      - '\OUTLOOK.EXE'
      - '\AcroRd32.exe'
      - '\Acrobat.exe'
  selection_payload_path:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\Downloads\'
  selection_payload_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.scr'
      - '.ps1'
      - '.hta'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection_client_image and selection_payload_path and selection_payload_ext and not filter_system_account

falsepositives:
  - Legitimate plugin/extension installers or browser update helpers writing executables to Temp/Downloads — tune AllowedPlugins/UserPaths to reduce noise.
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account.

level: medium

T1203 Exploitation for Client Execution

title: T1203 Exploitation for Client Execution
id: 5063b5e4-5ed6-4da5-9c2e-2066ba68626d
description: 'Exploitation for Client Execution via malicious documents/browser/third-party apps that spawn a shell or interpreter. Auditd EXECVE records do not expose parent-process identity (only a numeric ppid, no parent exe/name), so true PID-linked ancestry between the exploited application and a spawned shell cannot be established by a single flat detection rule -- that requires event correlation joining EXECVE records by pid/ppid chains, which is out of scope here. As a defensible proxy, this rule requires BOTH a known-vulnerable client app execution AND a shell/interpreter invocation whose own argv carries exploitation-typical indicators (reverse-shell socket redirection or remote fetch-and-execute), which sharply reduces the false-positive rate versus flagging any co-occurring app+shell exec. Tune using: TimeWindow, UserPaths, HighRiskChildren, PackageUpdaters.'
references:
  - https://attack.mitre.org/techniques/T1203
author: Shahrukh Khan
date: 2026-01-10
license: MIT
tags:
  - attack.execution
  - attack.t1203

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_parent_app:
    type: EXECVE
    a0|endswith:
      - '/soffice.bin'
      - '/evince'
      - '/xpdf'
      - '/acroread'
      - '/okular'
  selection_shell_child:
    type: EXECVE
    a0|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/python3'
      - '/perl'
    a1|contains: '-c'
  selection_suspicious_payload:
    a2|contains:
      - '/dev/tcp/'
      - '/dev/udp/'
      - 'base64 -d'
      - 'base64 --decode'
      - 'wget '
      - 'curl '
      - 'nc -e'

  condition: selection_parent_app and selection_shell_child and selection_suspicious_payload

falsepositives:
  - Legitimate document viewers/browsers occasionally invoke helper shells for printing, rendering, or update checks; the suspicious-payload requirement (reverse-shell socket or remote fetch-and-execute in the child's own argv) is intended to exclude ordinary helper invocations, but scripted print/render pipelines that legitimately call curl/wget could still match -- tune HighRiskChildren/PackageUpdaters accordingly.
  - True process ancestry (the shell being a direct child of the exploited app, not just co-occurring in the log) cannot be verified without event correlation across EXECVE pid/ppid chains, which this flat rule does not perform.

level: high

T1203 Exploitation for Client Execution

title: T1203 Exploitation for Client Execution
id: fa352bef-846c-46de-8824-f12ce7e7e8aa
description: 'Exploitation for Client Execution – cross-platform behavior chain (browser/Office/3rd-party apps). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimeWindow, HighRiskChildren, UserPaths, QuarantineBypass.'
references:
  - https://attack.mitre.org/techniques/T1203
author: Shahrukh Khan
date: 2026-05-30
license: MIT
tags:
  - attack.execution
  - attack.t1203

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|endswith:
      - '/Microsoft Word'
      - '/Microsoft Excel'
      - '/Preview'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/zsh'
      - '/osascript'
      - '/python3'
  condition: selection and selection_child

falsepositives:
  - Legitimate macro-enabled document workflows or PDF automation plugins spawning a scripting engine for approved business processes.

level: high

Explore