Malicious File Execution

An adversary may rely on a user opening or running a malicious file to gain code execution. Social engineering may induce this action. The file may arrive by email, web, chat, or another route, or already be placed on a shared location or the user's desktop; delivery is a precursor, not the T1204.002 action itself. ATT&CK examples include Office/PDF documents, shortcuts, executables, and disk images, and the technique spans Linux, Windows, and macOS. The procedure examples below focus on Windows Office, LNK, and executable/installer behavior.