AWS CreateAssociation
Creates a Systems Manager State Manager association.
Execution
Execution
Section titled “Execution”The adversary is trying to run malicious code.
Execution consists of techniques that result in adversary-controlled code running on a local or remote system. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data. For example, an adversary might use a remote access tool to run a PowerShell script that does Remote System Discovery.
In cloud environments, execution commonly involves invoking serverless functions (Lambda, Cloud Functions), running commands through instance metadata services, or leveraging cloud-native automation tools like SSM, CloudFormation, or Azure Automation. Adversaries may also abuse cloud shells and container orchestration platforms.
View Execution on MITRE ATT&CK →Events Related to Execution
Section titled “Events Related to Execution”Explore this tactic in the map.
AWS CreateStack
Requests provisioning of a CloudFormation stack from a template.
AWS Invoke
Requests synchronous, asynchronous, or dry-run Lambda invocation.
Azure Microsoft.Automation/automationAccounts/jobs/write
Creates an Azure Automation runbook job.
Azure Microsoft.Automation/automationAccounts/runbooks/write
Creates or updates an Azure Automation runbook resource.
Azure Microsoft.Compute/virtualMachines/extensions/write
Creates or updates an extension on an Azure virtual machine.
Azure Microsoft.Compute/virtualMachines/runCommand/action
Requests script execution through Azure VM Action Run Command.
Azure Microsoft.ContainerService/managedClusters/runCommand/action
Requests execution of a command through AKS Run Command.
AWS ModifyInstanceAttribute
Changes a supported EC2 instance attribute, including user data or security groups.
AWS ResumeSession
Reconnects to a disconnected SSM Session Manager session.
AWS SendCommand
Submits an SSM Run Command document to managed nodes.
AWS StartBuild
Starts a CodeBuild build with optional execution overrides.
AWS StartSession
Starts an SSM Session Manager session.