T1203: Exploitation for Client Execution
Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Several types exist:
### Browser-based Exploitation
Web browsers are a common target through Drive-by Compromise and Spearphishing Link. Endpoint systems may be compromised through normal web browsing or from certain users being targeted by links in spearphishing emails to adversary controlled sites used to exploit the web browser. These often do not require an action by the user for the exploit to be executed.
### Office Applications
Common office and productivity applications such as Microsoft Office are also targeted through Phishing. Malicious files will be transmitted directly as attachments or through links to download them. These require the user to open the document or file for the exploit to run.
### Common Third-party Applications
Other applications that are commonly seen or are part of the software deployed in a target network may also be used for exploitation. Applications such as Adobe Reader and Flash, which are common in enterprise environments, have been routinely targeted by adversaries attempting to gain access to systems. Depending on the software and nature of the vulnerability, some may be exploited in the browser or require the user to open a file. For instance, some Flash exploits have been delivered as objects within Microsoft Office documents.
Security context for executives and security teams
Exploitation for Client Execution is a high-value execution path because it turns normal user activity—opening a document, clicking a link, or browsing the web—into code execution on Windows, macOS, or Linux endpoints. For leaders, the practical issue is not only whether perimeter controls block phishing or malicious sites, but whether commonly used client software is patched, isolated, hardened, and monitored well enough to prevent a single vulnerable app from becoming an intrusion starting point.
Executive priority
Prioritize this technique where business-critical users rely heavily on browsers, office suites, PDF readers, or other third-party client applications. It affects operational resilience because compromise can begin through routine work activity and may bypass assumptions that users must intentionally run malware. Executive questions should focus on patch governance for client applications, exploit-protection baselines, sandboxing/isolation for high-risk workflows, and whether SOC and IR teams can reconstruct which application, file, link, and user action initiated execution.
Technical view
ATT&CK maps this technique to Execution across Linux, macOS, and Windows. The object describes browser-based exploitation through drive-by compromise and spearphishing links, office document exploitation through phishing attachments or downloads, and exploitation of common third-party applications. MITRE does not provide official detection text for T1203, but the related DET0287 detection strategy indicates a cross-platform behavior-chain approach for browser, Office, and third-party application activity. SOC and detection teams should validate visibility from the client application process outward: suspicious child processes, abnormal script or shell launches, unexpected file writes, exploit-mitigation events, crashes followed by execution, and network connections associated with opened documents or browsed sites.
Likely telemetry
- Endpoint process creation and parent-child process relationships for browsers, office applications, PDF readers, and other common client software
- Application crash, exploit-protection, and operating system security events
- File creation and download/open events for email attachments, office documents, PDFs, browser cache, and temporary directories
- Email and web gateway records for phishing links, attachments, and user navigation to adversary-controlled or suspicious sites
- EDR telemetry showing memory protection alerts, blocked exploit behavior, or unusual module/script execution
Detection direction
- Because MITRE provides no official detection procedure for this object, validate detections against behavior chains rather than single indicators: user receives or opens content, vulnerable client application handles it, then unexpected execution or network activity follows.
- Tune for high-signal parent-child relationships from browsers, office tools, and document readers spawning command shells, scripting engines, installers, or unfamiliar binaries, while accounting for legitimate enterprise plugins and update mechanisms.
- Correlate endpoint alerts with email and web telemetry to distinguish normal document handling from exploitation paths involving phishing attachments, downloaded files, or spearphishing links.
- Check blind spots in macOS and Linux client telemetry, not only Windows office workflows, because the ATT&CK platforms include all three.
- Use campaign and group relationships as threat-intelligence context showing broad historical relevance, but do not treat those relationships alone as evidence of local exposure or active targeting.
Mitigation priorities
- Maintain reliable update processes for operating systems, browsers, office applications, document readers, drivers, firmware, and common third-party client software, aligned with M1051 Update Software.
- Enable and enforce exploit-protection capabilities where available, aligned with M1050 Exploit Protection, to harden applications against conditions associated with exploitation.
- Use application isolation and sandboxing for high-risk client workflows, especially browsers and document-handling applications, aligned with M1048 Application Isolation and Sandboxing.
- Reduce unnecessary client application exposure by managing approved software, removing unsupported or end-of-life applications where possible, and confirming third-party application inventory is complete.
- Ensure incident response playbooks capture the originating application, opened file or link, user context, exploit-protection status, and patch state so containment decisions are evidence-based.
Additional notes and limits
This technique is materially important because it sits at the intersection of vulnerability management, endpoint hardening, email/web security, and SOC investigation quality. The many supplied campaign and group relationships indicate that client-side exploitation has been used across diverse threat activity, but those relationships should be used for prioritization context rather than attribution. The most defensible assessment for an organization comes from comparing software inventory and patch posture with endpoint, email, and web telemetry coverage.
The supplied ATT&CK object does not include official detection guidance, specific vulnerabilities, procedures, or indicators. The related detection strategy name supports a behavior-chain framing, but local validation is required to determine actual coverage. No claim is made here about active exploitation, customer exposure, guaranteed detection, or attribution beyond the provided ATT&CK relationships.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Exploitation for Client Execution
Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Several types exist:
### Browser-based Exploitation
Web browsers are a common target through Drive-by Compromise and Spearphishing Link. Endpoint systems may be compromised through normal web browsing or from certain users being targeted by links in spearphishing emails to adversary controlled sites used to exploit the web browser. These often do not require an action by the user for the exploit to be executed.
### Office Applications
Common office and productivity applications such as Microsoft Office are also targeted through Phishing. Malicious files will be transmitted directly as attachments or through links to download them. These require the user to open the document or file for the exploit to run.
### Common Third-party Applications
Other applications that are commonly seen or are part of the software deployed in a target network may also be used for exploitation. Applications such as Adobe Reader and Flash, which are common in enterprise environments, have been routinely targeted by adversaries attempting to gain access to systems. Depending on the software and nature of the vulnerability, some may be exploited in the browser or require the user to open a file. For instance, some Flash exploits have been delivered as objects within Microsoft Office documents.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.