T1204.001 Malicious Link
sub-techniqueEnterpriseAn adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution. Links may also lead users to download files that require execution via Malicious File.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-technique of
The broader entity this sits under.
mitigations
ATT&CK mitigations that reduce this.
detected by (4)
Data components that detect this.
countered by (D3FEND)
D3FEND countermeasures that counter this.
Detect
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- DE.CMContinuous Monitoringmoderate · backed by 5 of 11 mapped controls
- PR.DSData Securitymoderate · backed by 4 of 11 mapped controls
- PR.PSPlatform Securitymoderate · backed by 4 of 11 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (11)
Security controls that mitigate this.
known-exploited CVEs (11)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-38112US | —OT critical | KEV | ||
Windows MSHTML Platform Spoofing Vulnerability | ||||
| CVE-2023-5631US | medium5.4OT critical | KEV | ||
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_… | ||||
| CVE-2023-5217US | high8.8OT critical | KEV | ||
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a cra… | ||||
| CVE-2023-2136US | critical9.6OT critical | KEV | ||
Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a c… | ||||
| CVE-2022-3075US | critical9.6OT critical | KEV | ||
Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox es… | ||||
| CVE-2022-3038US | high8.8OT critical | KEV | ||
Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||||
| CVE-2022-21971US | high9.3OT critical | KEV | ||
Windows Runtime Remote Code Execution Vulnerability | ||||
| CVE-2022-24682US | medium6.1OT critical | KEV | ||
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attack… | ||||
| CVE-2020-3580US | medium6.1OT critical | KEV | ||
Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthen… | ||||
| CVE-2015-5119US | critical9.8OT critical | KEV | ||
Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows… | ||||
| CVE-2012-0767US | medium6.1OT critical | KEV | ||
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android… | ||||
groups (50)
Threat groups associated with this.
software (31)
Malware and tools associated with this.
campaigns (9)
Campaigns that use this.
Detected by (Sigma) (4)
Sigma detection rules related to this.
source
Where this definition is published.