ID	E1204
Objective(s)	Execution
Related ATT&CK Techniques	User Execution (T1204)
Version	2.0
Created	28 August 2019
Last Modified	17 August 2023

User Execution

Malware may include code that relies on specific actions by a user to execute. Note that this MBC behavior differs from User Execution in that it does do not include direct code execution (user action for initial execution) - MBC does not encompass ATT&CK's Initial Access Tactic.

This behavior is related to Unprotect technique U1339.

See ATT&CK Technique: User Execution (T1204).

Use in Malware

Name	Date	Method	Description
GoBotKR	2019	--	GoBotKR makes their malware look like the torrent content that the user intended to download, in order to entice a user to click on it. [1]
Rombertik	2015	--	The malware relies on a victim to execute itself. [2]
Terminator	2013	--	The malware relies on user interaction to execute. [3]
Vobfus	2016	--	The malware relies on user interaction to run the executable. [4]
CryptoLocker	2013	--	The malware relies on victims to execute. [4]
SearchAwesome	2018	--	The user opens a disk image file which invisibly installs its components. [6]