Exploitation for Client Execution (MITRE ATT&CK T1203) is the use of software vulnerabilities in client applications to run code. MITRE files it under Execution and lists Linux, Windows and macOS as platforms.
The target is the software your users run all day: browsers, office suites and document readers.
How attackers use it
MITRE explains that vulnerabilities come from unsafe coding practices that cause unexpected behavior, and that attackers can use them for arbitrary code execution. The most valuable exploits are often those that give code execution on a remote system, since they can be used to gain access to it. Users expect to see files for the applications they use for work, which makes those applications useful targets for exploit research.
MITRE groups the targets in three:
Browsers. Web browsers are commonly targeted through drive-by compromise and spearphishing links. Systems can be compromised through ordinary browsing, or when targeted users follow links in emails to attacker-controlled sites. These often need no action by the user for the exploit to run.
Office applications. Productivity software such as Microsoft Office is targeted through phishing. Malicious files arrive as attachments or through links, and the user has to open the document for the exploit to run.
Third-party applications. Other software common in enterprise environments, such as Adobe Reader and Flash, has been routinely targeted. Depending on the software and the flaw, exploitation may happen in the browser or require opening a file. Some Flash exploits were delivered as objects inside Office documents.
The MITRE page lists a long run of procedure examples, including exploitation of Office flaws, a browser flaw combined with a drive-by site, and ActiveX flaws. It also lists specific CVE identifiers there. Read them on the MITRE page if you want historical context.
How to detect it
MITRE's detection strategy is a cause and effect chain. On Windows:
- A client app (browser, Office, PDF or Flash reader) crashes, exits abnormally, or loads something from an unusual location.
- It then drops or modifies a file in a user-writable path.
- It spawns an unexpected child such as powershell, cmd, mshta, rundll32, wscript or an installer.
- A network connection to a command and control style destination follows shortly after.
On Linux, the chain is a crash or segfault of a browser, Office or reader process, a new executable, script or write in the home directory (Downloads, ~/.cache, /tmp), and an unexpected child such as curl, wget, bash or python that opens network connections.
On macOS, it is an app crash or abnormal termination in unified logs for Safari, Chrome, Office or Preview, new files in ~/Library, ~/Downloads or /private/var/folders, an unexpected child such as osascript, zsh, bash or curl, and new outbound connections.
Useful sources: application crash logs, endpoint process lineage, file creation events, and network egress logs, correlated over a short window. A crash by itself is common. A crash followed by a script host is not.
How to reduce the risk
MITRE's mitigations:
- Isolate and sandbox applications. Browser sandboxes reduce the impact of exploitation, though sandbox escapes may exist. Other virtualization and microsegmentation can help for client-side flaws.
- Use exploit protection. Tools that look for exploitation behavior, such as Windows Defender Exploit Guard, and control flow integrity checks can stop some attempts. Compatibility varies by application.
- Keep software updated. Regular patching of client software blocks known flaws and reduces the chance of a successful attack.
Check your own environment
- Do you know which versions of browsers, Office and PDF readers run across the fleet?
- How long do updates take to reach every device after release?
- Are older document viewers and browser plugins still installed, and are they used?
- Does your endpoint tooling alert when a browser, Office app or PDF reader launches a shell or script host?
- Is exploit protection enabled, and have you tested that it does not break your line-of-business apps?
- Do you collect application crash events centrally?
Quick check
Which of the three target groups can be exploited without the user opening a file?
Browser-based exploitation. MITRE says browser exploits often need no action from the user to run, while Office exploits need the user to open the document.
Why is a crash alone a weak signal?
Applications crash for many ordinary reasons. The signal gets strong when a crash is followed by new files in user-writable paths, an unexpected child process and outbound connections in a short window.
