T1204.001 — Malicious Link

Tactic: Execution · Platforms: Linux, macOS, Windows

An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking…

Sub-technique of User Execution (T1204).

Sigma detection rules (3)

T1204.001 User Execution: Malicious Link

title: "T1204.001 User Execution: Malicious Link"
id: e333a075-cea1-4c20-a12b-d86a03d8b299
description: 'Browser process connecting to a suspicious-TLD destination, consistent with clicking a malicious link. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, BrowserParents, UserPaths, SuspiciousTLDs, AllowedCDNs.'
references:
  - https://attack.mitre.org/techniques/T1204/001
author: Shahrukh Khan
date: 2026-04-10
license: MIT
tags:
  - attack.execution
  - attack.t1204.001

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '3'
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\iexplore.exe'
      - '\brave.exe'
    DestinationHostname|endswith:
      - '.xyz'
      - '.top'
      - '.click'
      - '.link'
      - '.tk'
      - '.info'
      - '.zip'
      - '.mov'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_system_account

falsepositives:
  - Legitimate browsing to services on listed TLDs.

level: medium

T1204.001 User Execution: Malicious Link

title: "T1204.001 User Execution: Malicious Link"
id: 7bff52d6-39e9-49b9-979f-d74773204d54
description: 'The click on a malicious link itself is a GUI/browser-internal action with no direct Linux syscall trace, and confirming that a spawned shell/interpreter is a child of the browser process requires cross-event correlation (matching a shell EXECVE record ppid to a prior browser EXECVE record pid) that a single-event auditd detection cannot express - the prior "all of selection*" logic was also self-contradictory, requiring one EXECVE record to simultaneously be both a browser and a shell/python process, which can never be true. As the closest single-event Linux-observable proxy, this rule instead flags execution of a shell/scripting interpreter against a script argument located in a browser download or cache directory, indicating a file was likely fetched via a clicked link/download and then executed. Tune using: TimeWindow, UserPaths, HighRiskExtensions, DomainRiskScore.'
references:
  - https://attack.mitre.org/techniques/T1204/001
author: Shahrukh Khan
date: 2026-05-06
license: MIT
tags:
  - attack.execution
  - attack.t1204.001

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_interpreter:
    type: EXECVE
    a0|endswith:
      - '/bash'
      - '/sh'
      - '/python3'
      - '/perl'
  selection_browser_path:
    a1|contains:
      - '/Downloads/'
      - '/.cache/mozilla/'
      - '/.mozilla/firefox/'
      - '/.config/google-chrome/'
      - '/.cache/google-chrome/'
      - '/tmp/mozilla'

  condition: selection_interpreter and selection_browser_path

falsepositives:
  - Users and administrators legitimately run downloaded legitimate scripts (installers, setup scripts) from their Downloads folder; this cannot distinguish a malicious-link-triggered download from an intentional, trusted one.

level: medium

T1204.001 User Execution: Malicious Link

title: "T1204.001 User Execution: Malicious Link"
id: e9271e79-565e-46bd-b0c2-49ea9ca8a7ad
description: 'User Execution – Malicious Link (click → suspicious egress → download/write → follow-on activity). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimeWindow, QuarantinePolicy, SuspiciousTLDs.'
references:
  - https://attack.mitre.org/techniques/T1204/001
author: Shahrukh Khan
date: 2026-03-21
license: MIT
tags:
  - attack.execution
  - attack.t1204.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|endswith:
      - '/Safari'
      - '/Google Chrome'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/osascript'
      - '/python3'
  condition: selection and selection_child

falsepositives:
  - Legitimate download-and-open workflows for approved installers; distinguishing a malicious link click from a benign one requires URL reputation data the network_connection category currently used for this rule does not capture, which is why the logsource has been retargeted to process_creation.

level: medium

Related sub-techniques

Explore