T1204.002 — Malicious File

Tactic: Execution · Platforms: Linux, macOS, Windows

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment.…

Sub-technique of User Execution (T1204).

Sigma detection rules (3)

T1204.002 User Execution: Malicious File

title: "T1204.002 User Execution: Malicious File"
id: d6d696e1-0b45-4760-b9e7-38c09275dc7e
description: 'User Execution – Malicious File via download/open → spawn chain (T1204.002). (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, SuspiciousExtensions, UserPaths, ParentApps, SignerAllowList.'
references:
  - https://attack.mitre.org/techniques/T1204/002
author: Shahrukh Khan
date: 2026-06-21
license: MIT
tags:
  - attack.execution
  - attack.t1204.002

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '11'

  selection_extension:
    TargetFilename|endswith:
      - '.iso'
      - '.img'
      - '.lnk'
      - '.hta'
      - '.js'
      - '.jse'
      - '.vbs'
      - '.vbe'
      - '.wsf'
      - '.wsh'
      - '.scr'
      - '.pif'
      - '.cpl'
      - '.chm'
      - '.msi'

  selection_delivery_path:
    TargetFilename|contains:
      - '\Downloads\'
      - '\Desktop\'
      - '\INetCache\'
      - '\Content.Outlook\'
      - '\Temp\'
      - '\Users\Public\'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and selection_extension and selection_delivery_path and not filter_system_account

falsepositives:
  - Legitimate ISO/MSI/LNK installers manually downloaded and run by users from Downloads/Desktop.

level: medium

T1204.002 User Execution: Malicious File

title: "T1204.002 User Execution: Malicious File"
id: f1ed3795-c8ee-4cbd-aaef-957a3bfc68b0
description: 'User Execution - Malicious File via download/open -> spawn chain (T1204.002). This half of the detection only observes delivery: a launcher-style file (.desktop/.sh/.AppImage) being created in a user-facing directory. It does not by itself prove the user executed it. Pair with the companion execution rule and the temporal_ordered correlation below, which requires this creation event to be followed by an EXECVE of the same file (or its .desktop launcher) within a 10-minute window before treating it as confirmed user execution. Tune using: TimeWindow, DesktopParentMap.'
references:
  - https://attack.mitre.org/techniques/T1204/002
author: Shahrukh Khan
date: 2026-06-16
license: MIT
tags:
  - attack.execution
  - attack.t1204.002

logsource:
  category: file_event
  product: linux

detection:
  selection:
    type: PATH
    nametype: CREATE
    name|contains:
      - '/Downloads/'
      - '/Desktop/'
    name|endswith:
      - '.desktop'
      - '.sh'
      - '.AppImage'

  condition: selection

falsepositives:
  - Legitimate AppImage or .desktop launcher downloads that a user never opens; this rule alone only confirms file delivery. Combine with the companion execution rule and the correlation below to require a real subsequent EXECVE before treating this as confirmed user execution.

level: low
---
title: "T1204.002 User Execution: Malicious File - Execution of Downloaded/Desktop File"
id: a3f1c9e2-6b7d-4e2a-9f3c-1d8b5a6e2c40
description: 'Companion detection for f1ed3795-c8ee-4cbd-aaef-957a3bfc68b0: captures the execution half of the User Execution - Malicious File chain (T1204.002) - a direct EXECVE of a previously-downloaded .sh/.AppImage file, or an xdg-open/gio launch of a .desktop file in the user''s Desktop directory. Used as the second leg of the temporal_ordered correlation below; on its own it is a weak signal since it cannot see the double-click/GUI-launch event, only the resulting process execution.'
references:
  - https://attack.mitre.org/techniques/T1204/002
author: Shahrukh Khan
date: 2026-06-16
license: MIT
tags:
  - attack.execution
  - attack.t1204.002

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_direct:
    type: EXECVE
    a0|contains:
      - '/Downloads/'
      - '/Desktop/'
    a0|endswith:
      - '.sh'
      - '.AppImage'
  selection_launcher:
    type: EXECVE
    a0|endswith:
      - '/xdg-open'
      - '/gio'
    a1|contains: '/Desktop/'

  condition: 1 of selection_*

falsepositives:
  - Users legitimately opening AppImages or shell scripts they downloaded intentionally and trust; developers running their own .sh build scripts from Desktop/Downloads.

level: medium
---
title: "T1204.002 User Execution: Malicious File - Confirmed Creation-to-Execution Chain"
id: b7e4d2a1-3c9f-4b6e-8a1d-5f2e9c7b3d64
description: 'Correlation companion linking f1ed3795-c8ee-4cbd-aaef-957a3bfc68b0 (file creation) and a3f1c9e2-6b7d-4e2a-9f3c-1d8b5a6e2c40 (execution): requires the creation of a launcher-style file to be followed, in order, by an EXECVE of that file within a 10-minute window, approximating the actual user-execution behavior T1204.002 describes rather than delivery alone. NOTE: group-by assumes a processing pipeline normalizes the PATH record''s name field and the EXECVE record''s a0 argv field onto a shared join field; without that field alignment the two rules will not correlate in a given backend.'
status: experimental
correlation:
  type: temporal_ordered
  rules:
    - f1ed3795-c8ee-4cbd-aaef-957a3bfc68b0
    - a3f1c9e2-6b7d-4e2a-9f3c-1d8b5a6e2c40
  group-by:
    - name
  timespan: 10m
  condition: "f1ed3795-c8ee-4cbd-aaef-957a3bfc68b0 and a3f1c9e2-6b7d-4e2a-9f3c-1d8b5a6e2c40"
level: high

T1204.002 User Execution: Malicious File

title: "T1204.002 User Execution: Malicious File"
id: 27ac207d-3668-40cf-8a9c-1f2f651e9835
description: 'User Execution – Malicious File via download/open → spawn chain (T1204.002). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimeWindow, QuarantineRequired, ParentApps.'
references:
  - https://attack.mitre.org/techniques/T1204/002
author: Shahrukh Khan
date: 2026-05-24
license: MIT
tags:
  - attack.execution
  - attack.t1204.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|endswith:
      - '/Safari'
      - '/Google Chrome'
      - '/Mail'
  selection_child:
    Image|contains: '.app/Contents/MacOS/'
  filter_known:
    Image|startswith: '/Applications/'
  condition: selection and selection_child and not filter_known

falsepositives:
  - Legitimate installation and first launch of a newly downloaded application from the Applications folder.

level: high

Related sub-techniques

Explore