value:  APT28 attempted to get users to click on Microsoft Office attachments containing malicious macro scripts. ;; APT29 has used various forms of spearphishing attempting to get a user to open attachments including but not limited to malicious Microsoft Word documents .pdf and .lnk files.  ;; APT30 has relied on users to execute malicious file attachments delivered via spearphishing emails. ;; APT32 has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment. ;; APT33 has used malicious e-mail attachments to lure victims into executing malware. ;; APT37 has sent spearphishing attachments attempting to get a user to open them. ;; APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious attachment. ;; Astaroth has used malicious files including VBS LNK and HTML for execution. ;; BlackTech has used e-mails with malicious documents to lure victims into installing malware. ;; BLINDINGCAN has lured victims into executing malicious macros embedded within Microsoft Office documents. ;; BRONZE BUTLER has attempted to get users to launch malicious Microsoft Word attachments delivered via spearphishing emails. ;; Bundlore has attempted to get users to execute a malicious .app file that looks like a Flash Player update. ;; Cardinal RAT lures victims into executing malicious macros embedded within Microsoft Excel documents. ;; CARROTBALL has been executed through users being lured into opening malicious e-mail attachments. ;; Cobalt Group has sent emails containing malicious attachments that require users to execute a file or macro to infect the victim machine. ;; CSPY Downloader has been delivered via malicious documents with embedded macros. ;; Dark Caracal makes their malware look like Flash Player Office or PDF documents in order to entice a user to click on it. ;; Darkhotel has sent spearphishing emails in an attempt to lure users into clicking on a malicious attachments. ;; DarkHydrus has sent malware that required users to hit the enable button in Microsoft Excel to allow an .iqy file to be downloaded. ;; Dragonfly 2.0 has used various forms of spearphishing in attempts to get users to open attachments. ;; Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open attachments. ;; Emotet has relied upon users clicking on a malicious attachment delivered through spearphishing. ;; FIN4 has lured victims to launch malicious attachments delivered via spearphishing emails (often sent from compromised accounts). ;; FIN6 has used malicious documents to lure victims into allowing execution of PowerShell scripts. ;; FIN7 lured victims to double-click on images in the attachments they sent which would then execute the hidden LNK file. ;; FIN8 has leveraged Spearphishing Attachments attempting to gain User Execution. ;; Frankenstein has used trojanized Microsoft Word documents sent via email which prompted the victim to enable macros. ;; Gallmaker sent victims a lure document with a warning that asked victims to “enable content” for execution. ;; Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded. ;; Gorgon Group attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails. ;; Grandoreiro has infected victims via malicious attachments. ;; The GuLoader executable has been retrieved via embedded macros in malicious Word documents. ;; Hancitor has used malicious Microsoft Word documents sent via email which prompted the victim to enable macros. ;; Higaisa used malicious e-mail attachments to lure victims into executing LNK files. ;; IcedID has been executed through Word documents with malicious embedded macros. ;; Inception lured victims into clicking malicious files for machine reconnaissance and to execute malware. ;; InvisiMole can deliver trojanized versions of software and documents relying on user execution. ;; Javali has achieved execution through victims opening malicious attachments including MSI files with embedded VBScript. ;; JCry has achieved execution by luring users to click on a file that appeared to be an Adobe Flash Player update installer. ;; Kerrdown has gained execution through victims opening malicious files. ;; KGH_SPY has been spread through Word documents containing malicious macros. ;; Kimsuky has used attempted to lure victims into opening malicious e-mail attachments. ;; Lazarus Group has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email. ;; Leviathan has sent spearphishing attachments attempting to get a user to click. ;; Lokibot has been executed through malicious documents contained in spearphishing e-mails. ;; Machete has has relied on users opening malicious attachments delivered through spearphishing to execute malware. ;; menuPass has attempted to get victims to open malicious files such as Windows Shortcuts (.lnk) and/or Microsoft Office documents sent via email as part of spearphishing campaigns. ;; Metamorfo requires the user to double-click the executable to run the malicious HTA file. ;; Mofang's malicious spearphishing attachments required a user to open the file after receiving. ;; Molerats has sent malicious files via email that tricked users into clicking Enable Content to run an embedded macro and to download malicious archives. ;; MuddyWater has attempted to get users to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails. ;; Mustang Panda has sent malicious files requiring direct victim interaction to execute. ;; Naikon has convinced victims to open malicious attachments to execute malware. ;; NETWIRE has been executed through luring victims into opening malicious documents. ;; OilRig has delivered macro-enabled documents that required targets to click the enable content" button to execute the payload on the system. ;; OSX/Shlayer relies on users mounting and executing a malicious DMG file. ;; Patchwork embedded a malicious macro in a Word document and lured the victim to click on an icon to execute the malware. ;; PLATINUM has attempted to get users to open malicious files by sending spearphishing emails with attachments to victims. ;; PLEAD has been executed via malicious e-mail attachments. ;; PoetRAT has used spearphishing attachments to infect victims. ;; Pony has attempted to lure targets into downloading an attached executable (ZIP RAR or CAB archives) or document (PDF or other MS Office format). ;; PROMETHIUM has attempted to get users to execute compromised installation files for legitimate software including compression applications security software browsers file recovery applications and other tools and utilities. ;; Ramsay has been executed through malicious e-mail attachments. ;; Rancor attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware. ;; REvil has been executed via malicious MS Word e-mail attachments. ;; Rifdoor has been executed from malicious Excel or Word documents containing macros. ;; RTM has attempted to lure victims into opening e-mail attachments to execute malicious code. ;; RTM has relied on users opening malicious email attachments decompressing the attached archive and double-clicking the executable within. ;; Sandworm Team has tricked unwitting recipients into clicking on spearphishing attachments and enabling malicious macros embedded within files. ;; Sharpshooter has sent malicious DOC and PDF files to targets so that they can be opened by a user. ;; Sidewinder has lured targets to click on malicious files to gain execution in the target environment. ;; Silence attempts to get users to launch malicious attachments delivered via spearphishing emails. ;; SQLRat relies on users clicking on an embedded image to execute the scripts. ;; StrongPity has been executed via compromised installation files for legitimate software including compression applications security software browsers file recovery applications and other tools and utilities. ;; SYSCON has been executed by luring victims to open malicious e-mail attachments. ;; TA459 has attempted to get victims to open malicious Microsoft Word attachment sent via spearphishing. ;; TA505 has used lures to get users to enable content in malicious attachments and execute malicious files contained in archives. For example TA505 makes their malware look like legitimate Microsoft Word documents .pdf and/or .lnk files. ;; TA551 has prompted users to enable macros within spearphishing attachments to install malware. ;; The White Company has used phishing lure documents that trick users into opening them and infecting their computers. ;; TrickBot has attempted to get users to launch malicious documents to deliver its payload. ;; Tropic Trooper has lured victims into executing malware via malicious e-mail attachments. ;; A Word document delivering TYPEFRAME prompts the user to enable macro execution. ;; Valak has been executed via Microsoft Word documents containing malicious macros. ;; Whitefly has used malicious .exe or .dll files disguised as documents or images. ;; Windshift has used e-mail attachments to lure victims into executing malicious code. ;; Wizard Spider has lured victims to execute malware with spearphishing attachments containing macros to download either Emotet Bokbot or TrickBot."
name: User Execution: Malicious File