Technique:  User Execution:Malicious File
During the 2015 Ukraine Electric Power Attack, It leveraged Microsoft Office attachments which contained malicious macros that were automatically executed once the user permitted them.
It has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails.
Agent Tesla has been executed through malicious e-mail attachments
It has lured victims into executing malicious files.
It has attempted to lure victims into enabling malicious macros within email attachments.
It has lured victims into opening weaponized documents, fake external drives, and fake antivirus to execute malicious payloads.
AppleJeus has required user execution of a malicious MSI installer.
AppleSeed can achieve execution through users running malicious file attachments distributed via email.
It has prompted victims to accept macros in order to execute the subsequent payload.
It has attempted to get victims to open malicious Microsoft Word and PDF attachment sent via spearphishing.
It attempted to get users to launch malicious attachments delivered via spearphishing emails.
It attempted to get users to click on Microsoft Office attachments containing malicious macro scripts.
It has used various forms of spearphishing attempting to get a user to open attachments, including, but not limited to, malicious Microsoft Word documents, .pdf, and .lnk files.
It has relied on users to execute malicious file attachments delivered via spearphishing emails.
It has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment.
It has used malicious e-mail attachments to lure victims into executing malware.
It has sent spearphishing attachments attempting to get a user to open them.
It  has attempted to lure victims into enabling malicious macros within email attachments.
It has sent spearphishing emails in an attempt to lure users to click on a malicious attachment.
Astaroth has used malicious files including VBS, LNK, and HTML for execution.
Bad Rabbit has been executed through user installation of an executable disguised as a flash installer.
BADFLICK has relied upon users clicking on a malicious attachment delivered through spearphishing.
Bandook has used lure documents to convince the user to enable macros.
Bisonal has relied on users to execute malicious file attachments delivered via spearphishing emails.
It has attempted to lure victims into opening malicious attachments delivered via spearphishing.
Black Basta has been downloaded and executed from malicious Excel files.
It has used e-mails with malicious documents to lure victims into installing malware.
BLINDINGCAN has lured victims into executing malicious macros embedded within Microsoft Office documents.
BoomBox has gained execution through user interaction with a malicious file.
It has attempted to get users to launch malicious Microsoft Word attachments delivered via spearphishing emails.
Brute Ratel C4 has gained execution through users opening malicious documents.
Bumblebee has relied upon a user opening an ISO file to enable execution of malicious shortcut files and DLLs.
Bundlore has attempted to get users to execute a malicious .app file that looks like a Flash Player update.
During C0011, It relied on a student target to open a malicious document delivered via email.
During C0015, the threat actors relied on users to enable macros within a malicious Microsoft Word document.
Cardinal RAT lures victims into executing malicious macros embedded within Microsoft Excel documents.
CARROTBALL has been executed through users being lured into opening malicious e-mail attachments.
Chaes requires the user to click on the malicious Word document to execute the next part of the attack.
Clambling has gained execution through luring victims into opening malicious files.
It has sent emails containing malicious attachments that require users to execute a file or macro to infect the victim machine.
It has lured victims to execute malicious attachments included in crafted spearphishing emails related to current topics.
CSPY Downloader has been delivered via malicious documents with embedded macros.
It has lured users into opening malicious files delivered via social media.
DanBot has relied on victims' opening a malicious file for initial execution.
It makes their malware look like Flash Player, Office, or PDF documents in order to entice a user to click on it.
It has sent spearphishing emails in an attempt to lure users into clicking on a malicious attachments.
It has sent malware that required users to hit the enable button in Microsoft Excel to allow an .iqy file to be downloaded.
DarkTortilla has relied on a user to open a malicious document or archived file delivered via email for initial execution.
Disco has been executed through inducing user interaction with malicious .zip and .msi files.
DnsSystem has lured victims into opening macro-enabled Word documents for execution.
It has used various forms of spearphishing in attempts to get users to open malicious attachments.
Dridex has relied upon users clicking on a malicious attachment delivered through spearphishing.
It required users to click on a malicious file for the loader to activate.
It has leveraged multiple types of spearphishing in order to attempt to get a user to open attachments.
It has attempted to lure victims into executing malicious files.
Emotet has relied upon users clicking on a malicious attachment delivered through spearphishing.
EnvyScout has been executed through malicious files attached to e-mails.
It has gained execution through victims clicking on malicious LNK files contained within ISO files, which can execute hidden DLLs within the ISO.
It has attempted to convince victims to enable malicious content within a spearphishing email by including an odd decoy message.
It has lured victims to launch malicious attachments delivered via spearphishing emails (often sent from compromised accounts).
It has used malicious documents to lure victims into allowing execution of PowerShell scripts.
It lured victims to double-click on images in the attachments they sent which would then execute the hidden LNK file.
It has used malicious e-mail attachments to lure victims into executing malware.
Flagpro has relied on users clicking a malicious attachment delivered through spearphishing.
During Frankenstein, the threat actors relied on a victim to enable macros within a malicious Microsoft Word document likely sent via email.
It sent victims a lure document with a warning that asked victims to "enable content" for execution.
It has attempted to get users to click on Office attachments with malicious macros embedded.
It attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.
Grandoreiro has infected victims via malicious attachments.
The GuLoader executable has been retrieved via embedded macros in malicious Word documents.
Hancitor has used malicious Microsoft Word documents, sent via email, which prompted the victim to enable macros.
It has relied on victim's executing malicious file attachments delivered via email or embedded within actor-controlled websites to deliver malware.
Heyoka Backdoor has been spread through malicious document lures.
It used malicious e-mail attachments to lure victims into executing LNK files.
IcedID has been executed through Word documents with malicious embedded macros.
It lured victims into clicking malicious files for machine reconnaissance and to execute malware.
It sent spearphishing emails containing malicious attachments that urged recipients to review modifications in the file which would trigger the attack.
It has attempted to get users to click on a malicious zipped file.
InvisiMole can deliver trojanized versions of software and documents, relying on user execution.
Javali has achieved execution through victims opening malicious attachments, including MSI files with embedded VBScript.
JCry has achieved execution by luring users to click on a file that appeared to be an Adobe Flash Player update installer.
JSS Loader has been executed through malicious attachments contained in spearphishing emails.
Kerrdown has gained execution through victims opening malicious files.
KGH_SPY has been spread through Word documents containing malicious macros.
It has used attempted to lure victims into opening malicious e-mail attachments.
KOCTOPUS has relied on victims clicking a malicious document for execution.
KONNI has relied on a victim to enable malicious macros within an attachment delivered via email.
KOPILUWAK has gained execution through malicious attachments.
It has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.
It has lured users to open malicious email attachments.
It has sent spearphishing attachments attempting to get a user to click.
Lokibot has tricked recipients into enabling malicious macros by getting victims to click "enable content" in email attachments.
It has relied on users opening malicious attachments delivered through spearphishing to execute malware.
It has attempted to lure victims into opening malicious email attachments.
It has attempted to get victims to open malicious files such as Windows Shortcuts (.lnk) and/or Microsoft Office documents, sent via email as part of spearphishing campaigns.
Metamorfo requires the user to double-click the executable to run the malicious HTA file or to download a malicious installer.
It's malicious spearphishing attachments required a user to open the file after receiving.
It has sent malicious files via email that tricked users into clicking Enable Content to run an embedded macro and to download malicious archives.
Mongall has relied on a user opening a malicious document for execution.
It has attempted to get users to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails.
It has sent malicious files requiring direct victim interaction to execute.
It has convinced victims to open malicious attachments to execute malware.
NativeZone can display an RTF document to the user  to enable execution of  Cobalt Strike stage shellcode.
NETWIRE has been executed through luring victims into opening malicious documents.
It as attempted to lure victims into clicking on malicious attachments within spearphishing emails.
Octopus has relied upon users clicking on a malicious attachment delivered through spearphishing.
It has delivered macro-enabled documents that required targets to click the "enable content" button to execute the payload on the system.
During Operation Dream Job, It lured victims into executing malicious documents that contained "dream job" descriptions from defense, aerospace, and other sectors.
During Operation Dust Storm, the threat actors relied on potential victims to open a malicious Microsoft Word document sent via email.
During Operation Honeybee, threat actors relied on a victim to enable macros within a malicious Word document.
During Operation Sharpshooter, the threat actors relied on victims executing malicious Microsoft Word or PDF files.
During Operation Spalax, the threat actors relied on a victim to open a PDF document and click on an embedded malicious link to download malware.
OSX/Shlayer has relied on users mounting and executing a malicious DMG file.
OutSteel has relied on a user to execute a malicious attachment delivered via spearphishing.
It embedded a malicious macro in a Word document and lured the victim to click on an icon to execute the malware.
It has attempted to get users to open malicious files by sending spearphishing emails with attachments to victims.
PLEAD has been executed via malicious e-mail attachments.
PoetRAT has used spearphishing attachments to infect victims.
Pony has attempted to lure targets into downloading an attached executable (ZIP, RAR, or CAB archives) or document (PDF or other MS Office format).
It has attempted to get users to execute compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.
QakBot has gained execution through users opening malicious attachments.
Ramsay has been executed through malicious e-mail attachments.
It attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware.
REvil has been executed via malicious MS Word e-mail attachments.
Rifdoor has been executed from malicious Excel or Word documents containing macros.
ROKRAT has relied upon users clicking on a malicious attachment delivered through spearphishing.
It has relied on users opening malicious email attachments, decompressing the attached archive, and double-clicking the executable within.
It has attempted to lure victims into opening e-mail attachments to execute malicious code.
Saint Bot has relied upon users to execute a malicious attachment delivered via spearphishing.
It has tricked unwitting recipients into clicking on spearphishing attachments and enabling malicious macros embedded within files.
It has attempted to lure victims into clicking on malicious embedded archive files sent via spearphishing campaigns.
It has lured targets to click on malicious files to gain execution in the target environment.
It attempts to get users to launch malicious attachments delivered via spearphishing emails.
Snip3 can gain execution through the download of visual basic files.
SQLRat relies on users clicking on an embedded image to execute the scripts.
Squirrelwaffle has relied on users enabling malicious macros within Microsoft Excel and Word attachments.
STARWHALE has relied on victims opening a malicious Excel file for execution.
StrongPity has been executed via compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.
Some SUGARDUMP variants required a user to enable a macro within a malicious .xls file for execution.
SVCReady has relied on users clicking a malicious attachment delivered through spearphishing.
SYSCON has been executed by luring victims to open malicious e-mail attachments.
It has used macro-enabled MS Word documents to lure victims into executing malicious payloads.
It has attempted to get victims to open malicious Microsoft Word attachment sent via spearphishing.
It has used lures to get users to enable content in malicious attachments and execute malicious files contained in archives. For example, It makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files.
It has prompted users to enable macros within spearphishing attachments to install malware.
Taidoor has relied upon a victim to click on a malicious email attachment.
It has used phishing lure documents that trick users into opening them and infecting their computers.
It has lured victims into opening malicious files containing malware.
ThreatNeedle relies on a victim to click on a malicious document for initial execution.
It has relied on user interaction to open their malicious RTF documents.
It has used weaponized documents in e-mail to compromise targeted systems.
TrickBot has attempted to get users to launch malicious documents to deliver its payload.
It has lured victims into executing malware via malicious e-mail attachments.
A Word document delivering TYPEFRAME prompts the user to enable macro execution.
Valak has been executed via Microsoft Word documents containing malicious macros.
WarzoneRAT has relied on a victim to open a malicious attachment within an email for execution.
It has used malicious .exe or .dll files disguised as documents or images.
It has used e-mail attachments to lure victims into executing malicious code.
It has attempted to lure users into opening malicious MS Word and Excel files to execute malicious payloads.
It has lured victims to execute malware with spearphishing attachments containing macros to download either Emotet, Bokbot, TrickBot, or Bazar.
Woody RAT has relied on users opening a malicious email attachment for execution.
ZxxZ has relied on victims to open a malicious attachment delivered via email.