User Execution via Malicious Link

An adversary may rely on a user clicking a malicious link to trigger execution. Depending on the destination, the click may lead to client-side exploitation or prompt the user to download and execute a file. The link-delivery behavior, such as spearphishing email, is tracked separately under the applicable Phishing technique; a click event alone does not prove that code executed.