# What does execution mean in MITRE ATT&CK?

Execution is the tactic of running the attacker's code on a system: a macro in a document, a script started by a user who was tricked, a command sent through a remote-administration tool, or a scheduled task. It happens inside the host, so the primary defence is there too: endpoint detection and response (EDR), application allow-listing, blocking macros in files from the internet, and limiting scripting tools for ordinary users. A network sensor does not see a process start. It sees the consequences that cross the network, which is often enough to raise the alarm: the new program downloading its next stage, then calling a server at regular intervals, or the machine beginning to scan its neighbours. NetSenX flags those on every plan; it cannot tell you which program on the host did it, which is a question for endpoint tools.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/what-is-execution-in-mitre-attack

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [What is persistence in a cyberattack?](https://netsenx.com/en/faq/what-is-persistence-in-a-cyberattack)
- [What is privilege escalation?](https://netsenx.com/en/faq/what-is-privilege-escalation)
- [What is the Stealth tactic in MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-the-stealth-tactic-in-mitre-attack)
- [What is Defense Impairment in MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-defense-impairment-in-mitre-attack)
- [What is credential access in a cyberattack?](https://netsenx.com/en/faq/what-is-credential-access)