Technique:  User Execution:Malicious Link
AppleJeus's spearphishing links required user interaction to navigate to the malicious website.
It has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.
It has used various forms of spearphishing attempting to get a user to click on a malicous link.
It has lured victims into clicking malicious links delivered through spearphishing.
It has lured targets to download a Cobalt Strike beacon by including a malicious link within spearphishing emails.
It has lured users to click links to malicious HTML applications delivered via spearphishing emails.
It has sent spearphishing emails in an attempt to lure users to click on a malicious link.
BackConfig has compromised victims via links to URLs hosting malicious content.
Bazar can gain execution after a user clicks on a malicious link to decoy landing pages hosted on Google Docs.
It has used e-mails with malicious links to lure victims into installing malware.
Bumblebee has relied upon a user downloading a file from a OneDrive link for execution.
During C0011, It relied on student targets to click on a malicious link sent via email.
During C0021, the threat actors lured users into clicking a malicious link which led to the download of a  ZIP archive containing a malicious .LNK file.
It has sent emails containing malicious links that require users to execute a file or macro to infect the victim machine.
It has lured victims into clicking on a malicious link sent through spearphishing.
It  has sent spearphishing emails that required the user to click on a malicious link and subsequently open a decoy document with a malicious loader.
It has leveraged multiple types of spearphishing in order to attempt to get a user to open links.
It has attempted to lure users to click on a malicious link within a spearphishing email.
Emotet has relied upon users clicking on a malicious link delivered through spearphishing.
It has sent spearphishing emails designed to trick the recipient into opening malicious shortcut links which downloads a .LNK file.
It has used malicious links to lure users into executing malicious payloads.
It has lured victims to click malicious links delivered via spearphishing emails (often sent from compromised accounts).
It has used malicious links to lure victims into downloading malware.
It has used emails with malicious links to lure victims into installing malware.
Grandoreiro has used malicious links to gain execution on victim machines.
GuLoader has relied upon users clicking on links to malicious documents.
Hancitor has relied upon users clicking on a malicious link delivered through phishing.
Javali has achieved execution through victims clicking links to malicious websites.
Kerrdown has gained execution through victims opening malicious links.
It has lured victims into clicking malicious links.
KOCTOPUS has relied on victims clicking on a malicious link delivered via email.
It has relied upon users clicking on links to malicious files.
It has sent spearphishing email links attempting to get a user to click.
It has lured victims into clicking malicious Dropbox download links delivered through spearphishing.
It has has relied on users opening malicious links delivered through spearphishing to execute malware.
It has attempted to lure victims into opening malicious links embedded in emails.
Melcoz has gained execution through victims opening malicious links.
It's spearphishing emails required a user to click the link to connect to a compromised website.
It has sent malicious links via email trick users into opening a RAR archive and running an executable.
It has distributed URLs in phishing e-mails that link to lure documents.
It has sent malicious links including links directing victims to a Google Drive folder.
NETWIRE has been executed through convincing victims into clicking malicious links.
During Night Dragon, threat actors enticed users to click on links in spearphishing emails to download malware.
ObliqueRAT has gained execution on targeted systems through luring users to click on links to malicious URLs.
It has delivered malicious links to achieve execution on the target system.
During Operation Dream Job, It lured users into executing a malicious link to disclose private account information or provide initial access.
During Operation Dust Storm, the threat actors relied on a victim clicking on a malicious link sent via email.
During Operation Spalax, the threat actors relied on a victim to click on a malicious link distributed via phishing emails.
OutSteel has relied on a user to click a malicious link within a spearphishing email.
It has used spearphishing with links to try to get users to click, download and open malicious files.
PLEAD has been executed via malicious links in e-mails.
Pony has attempted to lure targets into clicking links in spoofed emails from legitimate banks.
QakBot has gained execution through users opening malicious links.
Saint Bot has relied on users to click on a malicious link delivered via a spearphishing.
It has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.
It has lured targets to click on malicious links to gain execution in the target environment.
SMOKEDHAM has relied upon users clicking on a malicious link delivered through phishing.
Snip3 has been executed through luring victims into clicking malicious links.
SpicyOmelette has been executed through malicious links within spearphishing emails.
Squirrelwaffle has relied on victims to click on a malicious link send via phishing campaigns.
It has used malicious links to cloud and web services to gain execution on victim machines.
It has used lures to get users to click links in emails and attachments. For example, It makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files.
It has directed users to open URLs hosting malicious content.
TSCookie has been executed via malicious links embedded in e-mails spoofing the Ministries of Education, Culture, Sports, Science and Technology of Japan.
It has used spearphishing via a link to get users to download and run their malware.
It has used links embedded in e-mails to lure victims into executing malicious code.
It has lured victims into clicking a malicious link delivered through spearphishing.
ItM has used malicious links in e-mails to lure victims into downloading malware.