MITRE ATT&CK T1204.004 is a user-execution technique in which an attacker persuades a victim to copy, paste, or manually run malicious commands. Instead of exploiting software directly, the attacker relies on trust, curiosity, or urgency to make the user carry out the dangerous step. This is often seen in browser-to-shell attacks, fake support prompts, poisoned downloads, and social-engineering pages that present commands as part of a normal fix or verification process.
This technique matters because it bypasses many controls that focus on attachments or exploit signatures. Defenders should watch for unusual instructions that tell users to open terminals, paste code, or change security settings, especially when the request comes from a web page, ad, or chat message. Endpoint detection, command-line auditing, browser protections, and user training help reduce the risk, but the key defense is recognizing that a legitimate-looking prompt can still be an execution path for malware.