Execution : A Beginner friendly Guide in Cyber Security

CyberDefender 9 mins0

Execution is the set of techniques adversaries use to run adversary-controlled code on a local or remote system (workstation, server, mobile, cloud container, etc.). In ATT&CK terms it answers the question “how does the attacker make code actually run?” — whether by abusing script interpreters, convincing a user to open a file, invoking a service, or remotely starting a process.

Execution is the pivot from access → action. After initial access (phishing, exploit, stolen credentials), an attacker must execute code to expand access, move laterally, steal data, or establish persistence. Interrupting execution often stops the attack early.

Execution techniques are extremely common and versatile: many techniques are “multipurpose” (e.g., PowerShell can discover, download, execute, and stage further actions). Defenders see a lot of post-compromise activity centered on execution primitives.

Below is a clean, concise playbook and a practical remediation checklist for the MITRE ATT&CK Execution tactic (TA0002).

Purpose: Detect, contain, and respond to adversary attempts to run unauthorized code via scripting engines, binaries, user-launched payloads, or remote execution mechanisms.

  • Command and Scripting Interpreter — T1059
    Abuse of built-in interpreters (PowerShell, cmd, bash/sh, Python, JavaScript, WSH). Attackers run one-liners, scripts, or download+execute payloads via these interpreters. This is one of the most commonly abused execution families.

  • User Execution — T1204
    Tricks a human to perform an action (open a document, run a program, click a link). Phishing attachments, malicious macros, or “paste-and-run” social-engineering fall here. Because it relies on human action it’s common in initial access → execution chains (e.g., an email with a malicious Office file that runs macros).

  • Exploitation for Client Execution — (various technique pages)
    Exploiting vulnerabilities in client apps (browsers, PDF readers, Office) to get code execution without user intent. Attackers weaponize exploits to get a foothold and then run payloads.

  • Scheduled Task/Job & Service Execution (platform-specific techniques)
    Use OS scheduling or services to run code now or at scheduled times (also used for persistence by re-running payloads). Execution can be immediate (spawning a scheduled task) or deferred.

  • Remote Services (e.g., SSH, RDP) — T1021
    Use valid accounts to log in remotely and then run commands or binaries interactively (remote desktop, SSH shells, WinRM). This becomes execution on a remote host.

  • DLL Side-Loading / DLL Search Order Hijacking / Binary Planting / Process Injection
    Techniques that run code by manipulating how OS or apps load binaries or by injecting payloads into existing processes. These are stealthy and frequently paired with command interpreters or services. (See ATT&CK matrix pages for sub-techniques and examples.)

  • Container / Cloud Exec (Container CLI/API, Serverless Execution)
    Adversaries abusing container runtimes or cloud function invocation to execute malicious code in cloud hosts or containers. These are increasingly relevant in modern environments.

  • Event-Triggered Execution (e.g., WMI events, Scheduled triggers) — T1546 and related
    Use system eventing mechanisms (logon triggers, WMI subscriptions, other event hooks) to execute payloads when specific events occur. Useful for stealth/persistence.

1. High-Risk Techniques to Prioritize

2. Required Data Sources & Telemetry

Collect and centrally log:

Endpoint

  • Process creation (parent → child)
  • Command-line parameters
  • PowerShell Script Block + Module Logging
  • AMSI logs
  • Service creation / modification events
  • Scheduled task creation
  • DLL load events (if available in EDR)

Authentication / Remote Access

  • RDP logons (Success/Failure)
  • WinRM/PSRemoting logs
  • SSH access logs

Network

  • DNS logs
  • Proxy logs
  • TLS inspection metadata (JA3/JA3S if available)

3. Detection Rules / Hunts (Analyst Playbook)

A) Suspicious Interpreter Execution (T1059)

Triggers

  • winword.exe → powershell.exe
  • excel.exe → cmd.exe
  • outlook.exe → wscript.exe
  • Encoded commands: powershell.exe -enc, -EncodedCommand, unusual Base64 length
  • Curl/wget/Invoke-WebRequest followed by execution

Hunt Query Concepts

  • Parent process = Office app AND child = scripting engine
  • Command-line contains: download, iwr, bitsadmin, frombase64string

Action

  • Isolate host
  • Capture volatile memory via EDR
  • Block associated hashes/domains

B) User Execution (T1204)

Triggers

  • Macro-enabled Office files (.docm, .xlsm)
  • Office spawning script engines
  • User opened an attachment followed by suspicious network callouts

Hunt Query Concepts

  • File opened → within 2 minutes → script/payload spawned
  • Office child process tree > 3 layers deep

Action

  • Retrieve original email
  • Block sender / quarantine mailbox
  • Warn affected users

C) Remote Execution via RDP/SSH/WinRM (T1021)

Triggers

  • Lateral movement from unusual admin accounts
  • RDP login outside business hours
  • Sequential logons across many hosts

Hunt Query Concepts

  • Multiple authentication events followed by command execution
  • RDP/SSH logins from non-admin systems

Action

  • Disable compromised credentials
  • Review AD security logs for additional use
  • Network isolate affected machines

D) Scheduled Task / Service Execution (T1053/T1569)

Triggers

  • New scheduled tasks created outside maintenance windows
  • Services created running from non-standard directories
  • Service binary swapped or dropped recently

Hunt Query Concepts

  • schtasks.exe OR at.exe used by non-admin users
  • Event IDs: 4697 (service install), 7045 (service creation)

Action

  • Terminate malicious task/service
  • Remove persistence
  • Review file system for additional payloads

E) DLL/Path Hijacking (T1574)

Triggers

  • Application loads DLL from writable directory
  • Unsigned DLL replacing signed module in program folder

Hunt Query Concepts

  • Monitor DLL loads from %TEMP%, %APPDATA%, user-writable areas
  • Compare module signature vs parent binary signature

Action

  • Quarantine DLL and parent binary
  • Identify persistence mechanisms
  • Rebuild affected application if necessary

4. Response Playbook Summary

Immediate Response

  1. Isolate host from network
  2. Suspend malicious process
  3. Block associated indicators (hashes, URLs, IPs)
  4. Capture volatile evidence (EDR snapshot, memory if available)

Containment

  1. Disable compromised accounts
  2. Remove malicious tasks/services
  3. Terminate remote sessions
  4. Reset passwords & rotate secrets

Recovery

  1. Restore affected files/systems
  2. Rebuild corrupted binaries
  3. Re-enable safe scripting configs
  4. Apply missing patches

CyberDefender