Detecting and Mitigating Malicious File Execution (T1204.002)

Malicious File (MITRE ATT&CK T1204.002) is a sub-technique of user execution. The adversary relies on a user opening a file that leads to code execution. MITRE files it under Execution and lists Linux, Windows and macOS.

It usually follows a spearphishing attachment.

How attackers use it

MITRE lists many file types adversaries may use because they need a user to open them: .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg and .iso.

To raise the odds that a user opens the file and it works, attackers may use masquerading and obfuscation. That can include familiar naming conventions, or password-protecting the file and telling the user how to open it.

This often happens soon after initial access, but not always. An attacker may place a file in a shared directory or on a user's desktop at any phase and wait for someone to open it. It may also follow internal spearphishing.

Examples on the MITRE page include Office attachments with macros that ran once the user allowed them, and lures that asked victims to enable macros in email attachments.

How to detect it

MITRE's detection strategy looks at the file open, the file write and the process spawn.

Windows. A user opens a file delivered by email, web, chat or a share. The handler application (Word, a PDF reader, an archiver) creates a file in a user-controlled path such as Downloads, Temp or Desktop, then spawns a new or unusual child process such as powershell.exe, wscript.exe, cmd.exe, regsvr32.exe, rundll32.exe or msiexec.exe. Optional precursors are FileStreamCreated events for a URL or UNC path, and Office writing batch files into system32.

macOS. A user opens a downloaded document or installer. An EndpointSecurity file create event in ~/Downloads or ~/Library is followed by an exec of a suspicious utility such as osascript, bash or zsh, curl, chmod, or open with the -a Terminal option. Quarantine events (LSQuarantine) help.

Linux. A user or desktop app writes a new file to ~/Downloads, /tmp or mounted removable media, then execve runs a risky interpreter or loader (bash, sh, python, perl, php, node, curl or wget piping into sh, ld.so, rdesktop, xdg-open with unusual arguments). Use auditd file and execve records linked together.

In every case, the most useful single record is the parent and child process pair.

How to reduce the risk

MITRE's mitigations:

• Prevent risky behavior on the endpoint. On Windows 10, Attack Surface Reduction rules can block executables that were downloaded and run by Office, scripting interpreters or email clients, or that do not meet prevalence, age or trusted list criteria. Cloud-delivered protection must be on for certain rules.
• Use execution prevention. Application control may stop executables that masquerade as other files.
• Train users in phishing and spearphishing awareness and in how to raise a flag about suspicious files.

Check your own environment

On Windows (PowerShell), see which ASR rules are configured and what action each has:

Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions

On macOS, this shows whether a downloaded file carries the quarantine attribute (replace the file name with a real path):

xattr -l ~/Downloads/example.dmg

Then check:

• Are .iso, .lnk, .scr, .pif and .cpl files blocked or flagged at the email gateway?
• Do Office macros from the internet stay blocked by default?
• Do you alert when Word, Excel or a PDF reader starts a script host?
• Is application control in place on user workstations?

Quick check

Sources

• MITRE ATT&CK T1204.002: Malicious File