Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Execution/ T1203

T1203Exploitation for Client Execution

T1203 — Exploitation for Client Execution is a MITRE ATT&CK technique in the Execution tactic. Clankerusecase tracks 34 detection use cases covering it and 15 threat-intel articles citing it.

Execution
View on the matrix → Filter Detection Library MITRE official spec ↗
34Use cases
15Articles
0Sub-techniques
1Tactic

Use cases covering this technique (34)

[WEEKLY] AI/LLM Agent Framework Runtime Spawning Shell, Recon, or Egress Child Process Internal exploit · alerting DSΣPDDCS [WEEKLY] AI/LLM Framework Web Service Spawns Shell or Network Tool (Agent-Framework Unauthenticated RCE) Internal exploit · alerting DSΣPDDCS [WEEKLY] Service-process parent spawns subprocess containing CLI-argument-injection tokens Internal exploit · alerting DSΣPDD Sunburst Correlation DLL and Network Event ESCU actions · alerting P Windows MSC EvilTwin Directory Path Manipulation ESCU actions · alerting P Windows Remote Image Load ESCU actions · hunting P Cisco Secure Firewall - Binary File Type Download ESCU actions · hunting P Cisco Secure Firewall - Blocked Connection ESCU actions · hunting P Cisco Secure Firewall - Citrix NetScaler Memory Overread Attempt ESCU actions · alerting P Cisco Secure Firewall - High Priority Intrusion Classification ESCU actions · alerting P Cisco Secure Firewall - Malware File Downloaded ESCU actions · hunting P Cisco Secure Firewall - Possibly Compromised Host ESCU actions · hunting P Cisco Secure Firewall - Repeated Blocked Connections ESCU actions · hunting P Detect Windows DNS SIGRed via Splunk Stream ESCU actions · alerting P Detect Windows DNS SIGRed via Zeek ESCU actions · alerting P [LLM] Ray raylet/python spawning shell + ingress tooling (ShadowRay payload execution) Bespoke install · alerting DSΣPDDCS [LLM] Inbound HTML-attachment lure exploiting Zimbra XSS (CVE-2025-66376) Bespoke delivery · hunting DS [LLM] Unpatched Zimbra Collaboration exposed to CVE-2025-66376 (Void Blizzard target) Bespoke exploit · hunting DS [LLM] TidGi Desktop wiki worker spawning a command interpreter (TiddlyWiki startup-module RCE) Bespoke exploit · alerting DSΣPDDCS [LLM] SiYuan Electron client spawns command interpreter (XSS-to-RCE via child_process) Bespoke exploit · alerting DSΣPDDCS [LLM] SiYuan Electron renderer (nodeIntegration) spawning shell/LOLBin child — XSS-to-RCE Bespoke exploit · alerting DSΣPDDCS [LLM] Gamaredon WinRAR CVE-2025-8088 ADS path-traversal dropping HTA/VBS into Startup folder Bespoke install · alerting DSΣPDDCS [LLM] Vulnerable WindowsCodecs.dll (CVE-2025-50165) present on endpoint Bespoke exploit · hunting DSΣPDDCS [LLM] Process crash with faulting module WindowsCodecs.dll (CVE-2025-50165 exploit attempt) Bespoke exploit · hunting DSPDDCS [LLM] GitHub Actions branch-name template injection — bash brace-expansion shell signature Bespoke exploit · alerting DSΣPDDCS [LLM] cups-browsed spawning foomatic-rip or shell child (CVE-2024-47177 RCE) Bespoke exploit · alerting DSΣPDDCS [LLM] Curl invoked with SOCKS5-hostname resolution (CVE-2023-38545 exploit precondition) Bespoke exploit · hunting DSΣPDDCS [LLM] Hosts exposed to libwebp heap overflow CVE-2023-4863 / CVE-2023-5129 (TVM) Bespoke weapon · alerting DSP [LLM] Unpatched libwebp-bundling apps in software inventory (Chrome, Electron, 1Password, ImageMagick, GIMP, ffmpeg) Bespoke weapon · hunting DSP [LLM] Vulnerable OpenSSL 3.0.0–3.0.6 exposure (CVE-2022-3602 / CVE-2022-3786, 'SpookySSL') Bespoke exploit · hunting DSP [LLM] Vulnerable Snyk CLI (< v1.996.0) present — CVE-2022-40764 command injection exposure Bespoke weapon · alerting DSP [LLM] Snyk CLI spawning a shell — CVE-2022-40764 command injection via go-plugin vendor.json Bespoke exploit · alerting DSΣPDDCS [LLM] Exposure hunt: CVE-2020-15999 FreeType overflow in Chromium/Electron/CefSharp software Bespoke exploit · hunting DSP [LLM] Grunt task-runner (node.exe) spawning a command shell — possible js-yaml load() ACE Bespoke exploit · hunting DSΣPDD

Articles citing this technique (15)

crit CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE art-03
crit Russian Global Webmail Espionage art-217
crit [GHSA / CRITICAL] GHSA-9hc2-hjx8-q6pv: TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Modu art-271
crit [GHSA / CRITICAL] CVE-2026-50551: SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content art-295
crit [GHSA / CRITICAL] CVE-2026-54067: SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet() art-302
high Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances art-344
high Revisiting CVE-2025-50165: A critical flaw in Windows Imaging Component art-754
high Ultralytics AI Pwn Request Supply Chain Attack art-1149
high Zero-day RCE vulnerability found in CUPS - Common UNIX Printing System art-1230
high High severity vulnerability found in libcurl and curl (CVE-2023-38545) art-1572
high Critical WebP 0-day security CVE-2023-4863 impacts wider software ecosystem art-1581
crit Update: OpenSSL high severity vulnerabilities art-1962
crit Command injection vulnerability in Snyk CLI released prior to September 1, 2022 (older than v1.996.0) art-2011
crit Buffer overflow in Chromium affecting multiple packages art-3276
crit Arbitrary code execution in Grunt art-3321