Exploitation for Client Execution

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.

Several types exist:

Browser-based Exploitation

Web browsers are a common target through Drive-by Compromise and Spearphishing Link. Endpoint systems may be compromised through normal web browsing or from certain users being targeted by links in spearphishing emails to adversary controlled sites used to exploit the web browser. These often do not require an action by the user for the exploit to be executed.

Office Applications

Common office and productivity applications such as Microsoft Office are also targeted through Phishing. Malicious files will be transmitted directly as attachments or through links to download them. These require the user to open the document or file for the exploit to run.

Common Third-party Applications

Other applications that are commonly seen or are part of the software deployed in a target network may also be used for exploitation. Applications such as Adobe Reader and Flash, which are common in enterprise environments, have been routinely targeted by adversaries attempting to gain access to systems. Depending on the software and nature of the vulnerability, some may be exploited in the browser or require the user to open a file. For instance, some Flash exploits have been delivered as objects within Microsoft Office documents.

ID: T1203

Sub-techniques: No sub-techniques

Tactic: Execution

Platforms: Linux, Windows, macOS

System Requirements: Remote exploitation for execution requires a remotely accessible service reachable over the network or other vector of access such as spearphishing or drive-by compromise.

Data Sources: Anti-virus, Process monitoring, System calls

Supports Remote: Yes

Version: 1.1

Created: 18 April 2018

Last Modified: 28 March 2020

Version Permalink

Live Version

Procedure Examples

Name	Description
admin@338	admin@338 has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158.^[48]
APT12	APT12 has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities (CVE-2009-3129, CVE-2012-0158) and vulnerabilities in Adobe Reader and Flash (CVE-2009-4324, CVE-2009-0927, CVE-2011-0609, CVE-2011-0611).^[45]^[46]
APT28	APT28 has exploited Microsoft Office vulnerability CVE-2017-0262 for execution.^[40]
APT29	APT29 has used multiple software exploits for common client software, like Microsoft Word and Adobe Reader, to gain code execution as part of.^[16]
APT32	APT32 has used RTF document that includes an exploit to execute malicious code. (CVE-2017-11882)^[41]
APT33	APT33 has attempted to exploit a known vulnerability in WinRAR (CVE-2018-20250), and attempted to gain remote code execution via a security bypass vulnerability (CVE-2017-11774).^[42]^[43]
APT37	APT37 has used Flash Player (CVE-2016-4117, CVE-2018-4878) and Word (CVE-2017-0199) exploits for execution.^[13]^[14]^[15]
APT41	APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.^[49]
Bankshot	Bankshot leverages a known zero-day vulnerability in Adobe Flash to execute the implant into the victims’ machines.^[5]
BlackTech	BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.
BRONZE BUTLER	BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.^[28]^[29]
Cobalt Group	Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.^[30]^[31]^[32]^[33]^[34]^[35]^[36]^[37]
DealersChoice	DealersChoice leverages vulnerable versions of Flash to perform execution.^[6]
Elderwood	Elderwood has used exploitation of endpoint software, including Microsoft Internet Explorer Adobe Flash vulnerabilities, to gain execution. They have also used zero-day exploits.^[26]
EvilBunny	EvilBunny has exploited CVE-2011-4369, a vulnerability in the PRC component in Adobe Reader.^[11]
Frankenstein	Frankenstein has used CVE-2017-11882 to execute code on the victim's machine.^[54]
HAWKBALL	HAWKBALL has exploited Microsoft Office vulnerabilities CVE-2017-11882 and CVE-2018-0802 to deliver the payload.^[10]
Inception	Inception has exploited CVE-2012-0158, CVE-2014-1761, CVE-2017-11882 and CVE-2018-0802 for execution.^[50]^[51]^[52]^[53]
Lazarus Group	Lazarus Group has exploited Adobe Flash vulnerability CVE-2018-4878 for execution.^[5]
Leviathan	Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.^[24]^[25]
MuddyWater	MuddyWater has exploited the Office vulnerability CVE-2017-0199 for execution.^[55]
Patchwork	Patchwork uses malicious documents to deliver remote execution exploits as part of. The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.^[17]^[18]^[19]^[20]^[21]^[22]^[23]
Ramsay	Ramsay has been embedded in documents exploiting CVE-2017-0199 and CVE-2017-11882.^[12]
Sandworm Team	Sandworm Team has exploited vulnerabilities in Microsoft PowerPoint via OLE objects (CVE-2014-4114) and Microsoft Word via crafted TIFF images (CVE-2013-3906).^[56]^[57]^[58]
SpeakUp	SpeakUp attempts to exploit the following vulnerabilities in order to execute its malicious script: CVE-2012-0874, CVE-2010-1871, CVE-2017-10271, CVE-2018-2894, CVE-2016-3088, JBoss AS 3/4/5/6, and the Hadoop YARN ResourceManager. ^[9]
TA459	TA459 has exploited Microsoft Word vulnerability CVE-2017-0199 for execution.^[27]
The White Company	The White Company has taken advantage of a known vulnerability in Microsoft Word (CVE 2012-0158) to execute code.^[44]
Threat Group-3390	Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604.^[47]
Tropic Trooper	Tropic Trooper has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158.^[38]^[39]
Xbash	Xbash can attempt to exploit known vulnerabilities in Hadoop, Redis, or ActiveMQ when it finds those services running in order to conduct further execution.^[7]^[8]

Mitigations

Mitigation	Description
Application Isolation and Sandboxing	Browser sandboxes can be used to mitigate some of the impact of exploitation, but sandbox escapes may still exist. ^[3] ^[4] Other types of virtualization and application microsegmentation may also mitigate the impact of client-side exploitation. Risks of additional exploits and weaknesses in those systems may still exist. ^[4]
Exploit Protection	Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. ^[1] Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. ^[2] Many of these protections depend on the architecture and target application binary for compatibility.

Mitigation

Description

Application Isolation and Sandboxing

Browser sandboxes can be used to mitigate some of the impact of exploitation, but sandbox escapes may still exist. ^[3] ^[4]

Other types of virtualization and application microsegmentation may also mitigate the impact of client-side exploitation. Risks of additional exploits and weaknesses in those systems may still exist. ^[4]

Exploit Protection

Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. ^[1] Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. ^[2] Many of these protections depend on the architecture and target application binary for compatibility.

Detection

Detecting software exploitation may be difficult depending on the tools available. Also look for behavior on the endpoint system that might indicate successful compromise, such as abnormal behavior of the browser or Office processes. This could include suspicious files written to disk, evidence of Process Injection for attempts to hide execution, evidence of Discovery, or other unusual network traffic that may indicate additional tools transferred to the system.