Threadlinqs IntelligenceStart free

ATT&CK techniqueExecution

T1204.004 Malicious Copy and Paste

ExecutionEnterpriseSub-technique

As of 2026-10-05, T1204.004 (Malicious Copy and Paste) appears in 59 tracked threats, first reported 2026-05-06 and most recently 2026-10-03, with linked actors including APT38, Sapphire Sleet, Stardust Chollima; it most often appears alongside T1071.001 (Web Protocols).

Tracked threats
594 critical, 52 high, 3 medium
First seen
2026-05-06
Last seen
2026-10-03
Threat actors
28In the threats using it
Detection rules
175Blue tier and above

Data as of:

Activity timeline

T1204.004 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-08 with 18 reports, and 59 of the 59 threats were reported in the twelve months to 2026-10.

How adversaries use it

T1204.004 Malicious Copy and Paste is catalogued by MITRE ATT&CK under the Execution tactic in the Enterprise matrix, as a sub-technique of T1204 User Execution. Threadlinqs maps 59 of 2623 tracked threats (2.2%) to it; by severity that is 4 critical, 52 high, 3 medium.

Threats that use T1204.004 most often also use T1071.001 Web Protocols (45 threats), T1027 Obfuscated Files or Information (38 threats), T1082 System Information Discovery (37 threats), T1555.003 Credentials from Web Browsers (37 threats), T1059.001 PowerShell (34 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

28 tracked threat actors appear in the threats that use T1204.004; the most frequent are APT38 (4), Sapphire Sleet (3), Stardust Chollima (3), Woodgnat (3), Andariel (2).

Mitigations

MITRE ATT&CK lists 3 mitigations for T1204.004.

Data sources

Telemetry that can reveal T1204.004, per MITRE ATT&CK.

  • Command — Command Execution
  • File — File Creation
  • Network Traffic — Network Connection Creation, Network Traffic Content
  • Process — Process Creation

Threat actors using it

Tracked threats

The 30 most recent of 59 tracked threats that use T1204.004.

Detection coverage

Threadlinqs maintains 175 detection rules mapped to T1204.004 (SPL 68, KQL 52, Sigma 55). Rule content is available to Blue tier accounts and above; this page shows counts only.

175 detection rules (SPL/KQL/Sigma) · Blue and above. Compare plans

Parent technique

T1204 User Execution — 571 tracked threats at the technique level.