Code execution

Code execution is ordinary computing. In an investigation, the useful questions are which instructions ran, which program ran them, and what that program could access. MITRE’s Execution tactic covers adversary-controlled code; User Execution covers cases where an attacker relies on a person to get it running.

A download is not an execution

A downloaded file may never run. Reading a document need not execute its macro. A browser running a page’s JavaScript is different from a script interpreter running a command on the operating system. Record the environment and action instead of treating them as the same event.

Execution does not require administrator privileges. Code running as an ordinary user can still act within that user’s permissions. Establishing that code ran also does not, by itself, establish persistence or data theft.

Search ads to execution follows the trail from a browser visit to endpoint activity. ClickFix examines a more direct request to run supplied commands. Both depend on distinguishing what arrived from what actually ran.

For unfamiliar projects supplied during hiring, the recruiting-code article covers the decision about where, and whether, to run them.

Sources

• MITRE ATT&CK, Execution
• MITRE ATT&CK, User Execution

Related terms

• Malware
• Browser console
• Office macro
• ClickFix
• Sandboxing
• Application control

See it in practice

• From Search Ad to Download to Execution
• ClickFix: When the Instructions Are the Attack
• The Coding Interview Is Also a Software Trust Decision