What does execution mean in MITRE ATT&CK?

Execution is the tactic of running the attacker's code on a system: a macro in a document, a script started by a user who was tricked, a command sent through a remote-administration tool, or a scheduled task. It happens inside the host, so the primary defence is there too: endpoint detection and response (EDREDR: endpoint detection and response. Security software installed on each computer that watches what happens on that machine.), application allow-listing, blocking macros in files from the internet, and limiting scripting tools for ordinary users. A network sensor does not see a process start. It sees the consequences that cross the network, which is often enough to raise the alarm: the new program downloading its next stage, then calling a server at regular intervals, or the machine beginning to scan its neighbours. NetSenX flags those on every plan; it cannot tell you which program on the host did it, which is a question for endpoint tools.

← All 69 questions on Attack techniques explainedAll topics