Knowledge is Power
BARE METAL CYBERKnowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search exact control and technique identifiers, Cyber Wiki articles, framework records, playbooks, books, podcasts, Academy courses, individual lessons, and BMC Cyber Challenge activities.

Cyber Wiki Learning Path

MITRE ATT&CK®: Execution

Explore all active Enterprise ATT&CK v19.2 techniques and sub-techniques associated with the Execution objective, with defensive explanations and linked BMC learning resources.

Recommended Sequence

64 connected entries

All learning paths
ATT&CK sub-technique profile · Advanced

AppDomainManager (T1574.014)

AppDomainManager (T1574.014) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK sub-technique profile · Advanced

AppleScript (T1059.002)

AppleScript (T1059.002) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

At (T1053.002)

At (T1053.002) is an Enterprise ATT&CK sub-technique under Scheduled Task/Job. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution, Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

AutoHotKey & AutoIT (T1059.010)

AutoHotKey & AutoIT (T1059.010) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK technique profile · Intermediate

BITS Jobs (T1197)

BITS Jobs (T1197) is an Enterprise ATT&CK technique associated with Stealth, Persistence, Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

COR_PROFILER (T1574.012)

COR_PROFILER (T1574.012) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK sub-technique profile · Advanced

ClickOnce (T1127.002)

ClickOnce (T1127.002) is an Enterprise ATT&CK sub-technique under Trusted Developer Utilities Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK sub-technique profile · Advanced

Cloud API (T1059.009)

Cloud API (T1059.009) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK technique profile · Intermediate

Cloud Administration Command (T1651)

Cloud Administration Command (T1651) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Command and Scripting Interpreter (T1059)

An adversary uses a shell, command interpreter, scripting language, or administrative console to execute instructions and automate activity.

ATT&CK sub-technique profile · Advanced

Component Object Model (T1559.001)

Component Object Model (T1559.001) is an Enterprise ATT&CK sub-technique under Inter-Process Communication. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK technique profile · Intermediate

Container Administration Command (T1609)

Container Administration Command (T1609) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Container CLI/API (T1059.013)

Container CLI/API (T1059.013) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Container Orchestration Job (T1053.007)

Container Orchestration Job (T1053.007) is an Enterprise ATT&CK sub-technique under Scheduled Task/Job. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution, Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Cron (T1053.003)

Cron (T1053.003) is an Enterprise ATT&CK sub-technique under Scheduled Task/Job. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution, Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

DLL (T1574.001)

DLL (T1574.001) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK technique profile · Intermediate

Deploy Container (T1610)

Deploy Container (T1610) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Dylib Hijacking (T1574.004)

Dylib Hijacking (T1574.004) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK sub-technique profile · Advanced

Dynamic Data Exchange (T1559.002)

Dynamic Data Exchange (T1559.002) is an Enterprise ATT&CK sub-technique under Inter-Process Communication. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Dynamic Linker Hijacking (T1574.006)

Dynamic Linker Hijacking (T1574.006) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK technique profile · Intermediate

ESXi Administration Command (T1675)

ESXi Administration Command (T1675) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Executable Installer File Permissions Weakness (T1574.005)

Executable Installer File Permissions Weakness (T1574.005) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK technique profile · Intermediate

Exploitation for Client Execution (T1203)

Exploitation for Client Execution (T1203) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Hijack Execution Flow (T1574)

Hijack Execution Flow (T1574) is an Enterprise ATT&CK technique associated with Stealth, Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Hypervisor CLI (T1059.012)

Hypervisor CLI (T1059.012) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK technique profile · Intermediate

Input Injection (T1674)

Input Injection (T1674) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Inter-Process Communication (T1559)

Inter-Process Communication (T1559) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

JamPlus (T1127.003)

JamPlus (T1127.003) is an Enterprise ATT&CK sub-technique under Trusted Developer Utilities Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK sub-technique profile · Advanced

JavaScript (T1059.007)

JavaScript (T1059.007) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

KernelCallbackTable (T1574.013)

KernelCallbackTable (T1574.013) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK sub-technique profile · Advanced

Launchctl (T1569.001)

Launchctl (T1569.001) is an Enterprise ATT&CK sub-technique under System Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Lua (T1059.011)

Lua (T1059.011) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

MSBuild (T1127.001)

MSBuild (T1127.001) is an Enterprise ATT&CK sub-technique under Trusted Developer Utilities Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK sub-technique profile · Advanced

Malicious Copy and Paste (T1204.004)

Malicious Copy and Paste (T1204.004) is an Enterprise ATT&CK sub-technique under User Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Malicious File (T1204.002)

Malicious File (T1204.002) is an Enterprise ATT&CK sub-technique under User Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Malicious Image (T1204.003)

Malicious Image (T1204.003) is an Enterprise ATT&CK sub-technique under User Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Malicious Library (T1204.005)

Malicious Library (T1204.005) is an Enterprise ATT&CK sub-technique under User Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Malicious Link (T1204.001)

Malicious Link (T1204.001) is an Enterprise ATT&CK sub-technique under User Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK technique profile · Intermediate

Native API (T1106)

An adversary calls operating-system or runtime application programming interfaces directly to perform actions that might otherwise require ordinary utilities.

ATT&CK sub-technique profile · Advanced

Network Device CLI (T1059.008)

Network Device CLI (T1059.008) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Path Interception by PATH Environment Variable (T1574.007)

Path Interception by PATH Environment Variable (T1574.007) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK sub-technique profile · Advanced

Path Interception by Search Order Hijacking (T1574.008)

Path Interception by Search Order Hijacking (T1574.008) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK sub-technique profile · Advanced

Path Interception by Unquoted Path (T1574.009)

Path Interception by Unquoted Path (T1574.009) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK technique profile · Intermediate

Poisoned Pipeline Execution (T1677)

Poisoned Pipeline Execution (T1677) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

PowerShell (T1059.001)

PowerShell (T1059.001) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Python (T1059.006)

Python (T1059.006) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Scheduled Task (T1053.005)

Scheduled Task (T1053.005) is an Enterprise ATT&CK sub-technique under Scheduled Task/Job. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution, Persistence, Privilege Escalation context.

ATT&CK technique profile · Intermediate

Scheduled Task/Job (T1053)

An adversary creates or modifies a scheduled task, cron job, cloud schedule, or similar mechanism to run code at a chosen time or event.

ATT&CK technique profile · Intermediate

Serverless Execution (T1648)

Serverless Execution (T1648) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Service Execution (T1569.002)

Service Execution (T1569.002) is an Enterprise ATT&CK sub-technique under System Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Services File Permissions Weakness (T1574.010)

Services File Permissions Weakness (T1574.010) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK sub-technique profile · Advanced

Services Registry Permissions Weakness (T1574.011)

Services Registry Permissions Weakness (T1574.011) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK technique profile · Intermediate

Shared Modules (T1129)

Shared Modules (T1129) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Software Deployment Tools (T1072)

Software Deployment Tools (T1072) is an Enterprise ATT&CK technique associated with Execution, Lateral Movement. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

System Services (T1569)

System Services (T1569) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Systemctl (T1569.003)

Systemctl (T1569.003) is an Enterprise ATT&CK sub-technique under System Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Systemd Timers (T1053.006)

Systemd Timers (T1053.006) is an Enterprise ATT&CK sub-technique under Scheduled Task/Job. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution, Persistence, Privilege Escalation context.

ATT&CK technique profile · Intermediate

Trusted Developer Utilities Proxy Execution (T1127)

Trusted Developer Utilities Proxy Execution (T1127) is an Enterprise ATT&CK technique associated with Stealth, Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Unix Shell (T1059.004)

Unix Shell (T1059.004) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK technique profile · Intermediate

User Execution (T1204)

An adversary depends on a user to open, launch, approve, install, or otherwise trigger malicious content or code.

ATT&CK sub-technique profile · Advanced

Visual Basic (T1059.005)

Visual Basic (T1059.005) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Windows Command Shell (T1059.003)

Windows Command Shell (T1059.003) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK technique profile · Intermediate

Windows Management Instrumentation (T1047)

An adversary uses Windows Management Instrumentation to query, execute, configure, or remotely manage Windows systems.

ATT&CK sub-technique profile · Advanced

XPC Services (T1559.003)

XPC Services (T1559.003) is an Enterprise ATT&CK sub-technique under Inter-Process Communication. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.