> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-dfir-and-mittr/execution.md).

# Execution

* [Prefetch](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/windows-artifacts/application-execution/prefetch)
  \*
* T1203: Exploitation for Client Execution
* T1559: Inter-Process Communication
* T1106: Native API
* T1059: Command and Scripting Interpreter, with sub-techniques for Command Shell (T1059.003), PowerShell (T1059.001), and Visual Basic (T1059.005)
* T1053: Scheduled Task/Job, including sub-techniques for At (T1053.002), Scheduled Task (T1053.005), and Systemd Timers (T1053.004)
* T1129: Shared Modules
* T1204: User Execution, with sub-techniques for Malicious File (T1204.002) and Malicious Link (T1204.001)
* T1047: Windows Management Instrumentation