Detecting and Mitigating Malicious Link Execution (T1204.001)

Malicious Link (MITRE ATT&CK T1204.001) is a sub-technique of user execution. The adversary relies on a user clicking a link that leads to code execution. MITRE files it under Execution and lists Linux, Windows and macOS.

How attackers use it

Users may be socially engineered into clicking a link, and this typically follows a spearphishing link message. MITRE notes that a click may lead to other techniques, such as exploitation of a browser or application flaw, or a download of a file that the user then has to run, which is the malicious file technique.

The MITRE page lists many actors who sent links in emails, some impersonating official notifications or trusted senders.

How to detect it

MITRE's detection strategy follows the click, the connection and the download.

1. A user-facing app (browser, Office or email client) opens a URL.
2. The same process lineage connects to an untrusted domain or IP address.
3. A file is downloaded or unpacked to a user-writable location shortly afterward.

On Linux the file lands in Downloads, /tmp or a cache directory. On macOS, unified logs show the open or click or an LSQuarantine assignment, and the file appears in ~/Downloads or /private/var/folders with the quarantine flag. Optional enrichment: child execution by living-off-the-land binaries afterward.

Proxy and DNS logs, newly seen domain alerts, and endpoint file creation events give you the data.

How to reduce the risk

MITRE's mitigations:

• Network intrusion prevention. Use systems that block visits to bad links and scan and remove malicious downloads.
• Restrict web-based content. Block unknown or unused file types in transit by default, such as .scr, .exe, .pif and .cpl, and consider tools that can open and analyze compressed and encrypted archives such as zip and rar.
• User training on phishing and spearphishing, and on how to raise suspicion about odd events.

Quick check

Sources

• MITRE ATT&CK T1204.001: Malicious Link