User Execution
The message, or a page or file it leads to, gives steps for running code on your device, such as a command, script, or program. Code you start yourself runs with your access, which is why attackers ask for it.
Mapped to
MITRE ATT&CK®
Sub-techniques
TE0021.1
PowerShell Execution
The message, or a page it leads to, tells you to run a command or script in PowerShell, a Windows tool for typing commands. A single pasted command can download and start other programs.
TE0021.2
Remote-Support Tool Execution
The message, or a page it leads to, asks you to install or open a remote-support app, such as Quick Assist, which lets someone else see and control a computer. Attackers ask for this to work on the device directly.
TE0021.3
Windows Command Shell Execution
The message, or a page it leads to, tells you to run a command or batch script in the Windows Command Prompt, the text window for typing system commands. Commands run there have your access.
TE0021.4
Unix Shell Execution
The message, or a page it leads to, tells you to run a command in a Mac or Linux Terminal, such as in bash or zsh. A pasted line runs with your access and can download and run other programs.
TE0021.5
Macro Enablement
The message, or the document itself, tells you to enable content, editing, or macros in an Office file. Macros are small programs inside the document, and enabling them lets that code run.