Execution

This part of the ATT&CK framework is when an attacker already has some foothold in a network. For example, the victim has opened a malicious attachment that's been received by email and is moving their mouse to click on execute macros, or when attackers have sent a payload to a vulnerable server and the payload is being processed by the engine before sending the shell back to the threat actor.

This phase will occur when malicious code needs to be executed again and again until the attacker has reached their objectives. The famous motto from SANS, Malware can hide but it must run, illustrates these techniques perfectly. We will start by looking at built-in methods as they represent the simplest and fastest way to run code.

T1059 – Command and scripting interpreter

The easiest way to interact with a remote host is to use the tools that are already installed. This is why so many malware and attacks rely on the usage of built-in interpreters. Most of...