Execution
Execution techniques allow adversaries to run malicious code on target systems — through scripting interpreters, user interaction, scheduled tasks, or container commands. ManySignal detects anomalous execution patterns across endpoints, cloud, and containers.
Coverage
- Techniques covered
- 12
- Detection rules
- 48
- PowerShell rules
- 16
Threat context
How adversaries execute malicious code
Execution is the step where an adversary transitions from access to action. In Windows environments, PowerShell dominates because it is ubiquitous, trusted, and capable of in-memory execution. Encoded commands, download cradles, and AMSI bypass techniques allow attackers to execute complex payloads without leaving files on disk. In cloud environments, the cloud CLI (aws, gcloud, az) is the equivalent — a sequence of API calls that enumerate, escalate, and exfiltrate.
ManySignal detects execution anomalies through EDR telemetry (CrowdStrike, SentinelOne), PowerShell Script Block Logging events, and Kubernetes audit logs — providing coverage from endpoint to cloud-native execution paths.
Execution techniques ManySignal detects
Command and Scripting Interpreter
PowerShell, Bash, Python, and cloud CLI abuse for code execution.
User Execution
Malicious files or links executed by a user through social engineering.
Scheduled Task/Job
Scheduled tasks, cron jobs, and cloud function triggers used to execute code.
Deploy Container
Deploying containers with privileged settings to execute code in Kubernetes.
Container Administration Command
kubectl exec, docker exec, and cloud shell access to execute commands in containers.
Execution: frequently asked questions
What is ATT&CK Execution (TA0002)?
Execution covers the techniques adversaries use to run malicious code on a target system. It is typically the second phase of an attack, following Initial Access, and enables adversaries to install tools, perform reconnaissance, and establish persistence.
Why is PowerShell a common execution technique?
PowerShell is built into Windows, trusted by the OS, and capable of downloading and executing code from memory without writing to disk. This combination makes it ideal for attackers who want to evade file-based detection while maintaining full system access.
How does ManySignal detect execution in Kubernetes environments?
ManySignal ingests Kubernetes audit logs and detects anomalous kubectl exec, container privilege escalation, and privileged pod deployment events. These are correlated with the user identity performing the action and their historical access patterns.
Detect malicious execution across endpoints and cloud
ManySignal ingests EDR telemetry, PowerShell script block logs, and Kubernetes audit events to surface anomalous execution within minutes.