Execution (20 techniques)

Running adversary-controlled code on a local or remote system.

The Execution tactic groups MITRE ATT&CK techniques used by adversaries to running adversary-controlled code on a local or remote system. Each technique below has its own page with detection guidance, platforms, and sub-techniques.

Detection engineering training, taught by practitioners.

Learn how to build real detections across the MITRE ATT&CK framework.

View Courses