Trusted Design
Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Several types exist:
Web browsers are a common target through Drive-by Compromise and Spearphishing Link. Endpoint systems may be compromised through normal web browsing or from certain users being targeted by links in spearphishing emails to adversary controlled sites used to exploit the web browser. These often do not require an action by the user for the exploit to be executed.
Common office and productivity applications such as Microsoft Office are also targeted through Phishing. Malicious files will be transmitted directly as attachments or through links to download them. These require the user to open the document or file for the exploit to run.
Other applications that are commonly seen or are part of the software deployed in a target network may also be used for exploitation. Applications such as Adobe Reader and Flash, which are common in enterprise environments, have been routinely targeted by adversaries attempting to gain access to systems. Depending on the software and nature of the vulnerability, some may be exploited in the browser or require the user to open a file. For instance, some Flash exploits have been delivered as objects within Microsoft Office documents.
T1203「Exploitation for Client Execution」（クライアント実行のための脆弱性悪用） は、ユーザーが使用するアプリケーション（ブラウザ、ドキュメントビューアー、メディアプレーヤーなど）の脆弱性を突き、悪意のあるコードを実行させる手法です。
この手法で攻撃者は、「ユーザーの不注意やソフトのバグを突き、システムへの足がかりを得ること」を実現します。
この攻撃は、ソフトウェアの設計上のミス（バグ）を「武器（エクスプロイト）」として利用します。
「隙（脆弱性）」をなくし、実行された際の被害を最小限に抑えることが重要です。
不審なメールの添付ファイルを、仮想環境（サンドボックス）やブラウザのプレビュー機能だけで確認させる運用は、この T1203 に対する非常に有効な「現場レベル」の防御策になります。