Trap (T1154)

View on ATT&CK

In Playbook

Technique & Subtechniques

  • Trap

Associated Tactics

  • Execution
  • Persistence

Execution (TA0002)

The adversary is trying to run malicious code. Execution consists of techniques that result in adversary-controlled code running on a local or remote system. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data. For example, an adversary might use a remote access tool to run a PowerShell script that does Remote System Discovery.

View on ATT&CK

Procedure Examples

Description Source(s)
ss64. (n.d.). trap. Retrieved May 21, 2019. Trap Manual
Cyberciti. (2016, March 29). Trap statement. Retrieved May 21, 2019. Cyberciti Trap Statements