For Execution, the most observed technique by DirectDefense is Malicious File Execution, tricking users into running malware via phishing and social engineering. Alerts triggered for Execution include: Malicious File Detected.

DirectDefense mapped alerts to the MITRE ATT&CK® framework to identify the top five tactics. The top five tactics identified are: Initial Access, Persistence, Lateral Movement, Execution, and Credential Access.