ATT&CK coverage › Technique

Exploitation for Client Execution T1203

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.

Events covered

10 catalog events are tagged with this technique by at least one rule.

ProviderEvent IDTitle
Sysmon1Process creation
Sysmon3Network connection
Sysmon7Image loaded
Sysmon11FileCreate
Sysmon22DNSEvent (DNS query)
Security-Auditing4663An attempt was made to access an object.
Security-Auditing4688A new process has been created.
Defender-DeviceFileEvents9002001File created
Defender-DeviceProcessEvents9001000Process activity (any)
Audit-CVE1Possible detection of CVE: PossibleDetectionOfCVE.

Authoring guide

Patterns shared across the 13 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (19 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
Image8ends_with 7, match 1\rundll32.exe, \pwsh.exe, \regsvr32.exe, C:\\Windows\\System32\\spool\\drivers\\color\\, \eqnedt32.exe
CommandLine5match 4, eq 1, ends_with 1.webp, .jse, address=localhost, jdk1., transport=dt_socket,address=
ParentImage5ends_with 5\KeyScrambler.exe, \WinRAR.exe, \ArcSOC.exe, \Hwp.exe, \spoolsv.exe
OriginalFileName3eq 3RUNDLL32.EXE, regsvr32.exe, PowerShell.EXE
FileName2eq 1, ends_with 1wscript.exe, .dll, .exe
DeviceId1eq 1VulnDevices
InitiatingProcessFileName1in 1winword.exe, outlook.exe, excel.exe
ActionType1eq 1FileCreated
Provider_Name1eq 1Audit-CVE, Microsoft-Windows-Audit-CVE
DestinationHostname1ends_with 1.deploy.static.akamaitechnologies.com
Protocol1eq 1tcp
Initiated1eq 1true
dest_ip1cidr_match 152.244.37.168/32, 23.35.224.0/20, 2a01:111:f100:2002::8975:2da8/128
DestinationPort1eq 1443, 995, 25
IntegrityLevel1eq 1S-1-16-16384, System

Top indicator values (222 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.

FieldKindValueRules (here)Corpus reach
Imageends_with\cmd.exe492
Imageends_with\pwsh.exe4140
Imageends_with\rundll32.exe476
Imageends_with\powershell.exe4143
Imageends_with\wscript.exe364
Imageends_with\cscript.exe364
Imageends_with\regsvr32.exe357
Imageends_with\mshta.exe357
OriginalFileNameeqRUNDLL32.EXE328
OriginalFileNameeqCmd.Exe232
OriginalFileNameeqPowerShell.EXE264
OriginalFileNameeqregsvr32.exe24
OriginalFileNameeqcscript.exe215
OriginalFileNameeqmshta.exe26
OriginalFileNameeqwscript.exe215
OriginalFileNameeqpwsh.dll272
Imageends_with\wmic.exe237
DeviceIdeqVulnDevices1
CommandLinematch.webp1
InitiatingProcessFileNameinoutlook.exe1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 9 rules

Splunk 1 rule

Kusto Query Language 3 rules