CWE-502: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. This is a Glexia lookup hint from CWE context, not an official ATT&CK mapping.
Open ATT&CK lookup