User Execution
Technique · ATTACK:ics:T0863
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:ics:T0863",
"title": "User Execution",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T0863",
"snapshot": "ics-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--2736b752-4ec5-4421-a230-8977dea7649c",
"external_id": "T0863",
"domain": "ics",
"created": "2020-05-21T17:43:26.506Z",
"modified": "2026-10-13T17:48:50.591Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"execution"
],
"source_references": [
{
"source_name": "Booz Allen Hamilton",
"url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
},
{
"source_name": "Daavid Hentunen, Antti Tikkanen June 2014",
"url": "https://www.f-secure.com/weblog/archives/00002718.html"
},
{
"source_name": "CISA AA21-201A Pipeline Intrusion July 2021",
"url": "https://us-cert.cisa.gov/sites/default/files/publications/AA21-201A_Chinese_Gas_Pipeline_Intrusion_Campaign_2011_to_2013%20(1).pdf"
}
]
}Explicit source assertions (10)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:ics:M0938 → mitigates → ATTACK:ics:T0863
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--07f4d65d-4572-450f-8cb2-908fee97bd67
ATTACK:ics:M0921 → mitigates → ATTACK:ics:T0863
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1aa02c37-973e-46bd-ab45-609463e514e9
ATTACK:ics:S0496 → uses → ATTACK:ics:T0863
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1fd4cf4e-a26c-4fe5-a7fd-f49b8aea8437
Tom Fakterman August 2019ATTACK:ics:S0093 → uses → ATTACK:ics:T0863
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5bb313a8-8407-4ec1-a4b0-683ded7f3302
Daavid Hentunen, Antti Tikkanen June 2014 · Kyle WilhoitATTACK:ics:M0917 → mitigates → ATTACK:ics:T0863
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71c9db9c-6f0c-4e33-a20a-dcd5b791a49a
ATTACK:ics:S0603 → uses → ATTACK:ics:T0863
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8a06c15b-b7e5-4374-9265-8d9020e126cd
Nicolas Falliere, Liam O Murchu, Eric Chien February 2011ATTACK:ics:M0931 → mitigates → ATTACK:ics:T0863
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b1d993d5-9e7e-4043-a651-07c7b5ad5a6b
ATTACK:ics:M0949 → mitigates → ATTACK:ics:T0863
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d3c94120-e6b5-4bd2-88f0-9c73f76b0104
ATTACK:ics:M0945 → mitigates → ATTACK:ics:T0863
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e09e253c-fd28-49ae-988e-1f80d769e8b8
ATTACK:ics:S0606 → uses → ATTACK:ics:T0863
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--edf73653-b2d7-422f-b433-b6a428ff12d4
Orkhan Mamedov, Fedor Sinitsyn, Anton Ivanov October 2017