Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.
There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic.
Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.(Citation: Powershell Remote Commands)(Citation: Cisco IOS Software Integrity Assurance - Command History)(Citation: Remote Shell Execution in Python)
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CIS-13.7 | Deploy a Host-Based Intrusion Prevention Solution | mitigates | T1059 | Command and Scripting Interpreter |
Comments
Host-based intrusion prevention capabilities can enforce behavioral controls such as Attack Surface Reduction rules to prevent Visual Basic and JavaScript from executing potentially malicious downloaded content.
References
|
| CIS-10.7 | Use Behavior-Based Anti-Malware Software | mitigates | T1059 | Command and Scripting Interpreter |
Comments
Behavioral anti-malware commonly monitors scripting engines and detects malicious script execution through behavioral indicators rather than signatures.
References
|
| CIS-9.7 | Deploy and Maintain Email Server Anti-Malware Protections | mitigates | T1059 | Command and Scripting Interpreter |
Comments
Email anti-malware can block suspicious script attachments before they reach an interpreter. Most command and scripting activity occurs after compromise or through channels unrelated to email.
References
|
| CIS-2.5 | Allowlist Authorized Software | mitigates | T1059 | Command and Scripting Interpreter |
Comments
If interpreters themselves are restricted or constrained by allowlisting, adversary-launched unauthorized interpreter binaries are blocked.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.hacking.variety.OS commanding | OS commanding. Child of 'Exploit vuln'. | related-to | T1059 | Command and Scripting Interpreter | |
| action.hacking.variety.Abuse of functionality | Abuse of functionality. | related-to | T1059 | Command and Scripting Interpreter | |
| action.hacking.vector.Command shell | Remote shell | related-to | T1059 | Command and Scripting Interpreter |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| google_secops | Google Security Operations | technique_scores | T1059 | Command and Scripting Interpreter |
Comments
Google Security Ops is able to trigger an alert based on system events of interest, for example: decoding Windows payloads using \"certutil.exe\" functionality.
This technique was scored as minimal based on low or uncertain detection coverage factor.
https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/soc_prime_rules/threat_hunting/process_creation/suspicious_certutil_command.yaral
References
|
| virus_total | Virus Total | technique_scores | T1059 | Command and Scripting Interpreter |
Comments
VirusTotal, now part of Google Cloud, provides threat context and reputation data to help analyze suspicious files, URLs, domains, and IP addresses to detect cybersecurity threats.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| aws_web_application_firewall | AWS Web Application Firewall | technique_scores | T1059 | Command and Scripting Interpreter |
Comments
The AWS WAF protects web applications from injection attacks that leverage command and scripting interpreters. AWS WAF provides this protection via the following rule sets that block malicious traffic across a variety of operating systems and applications: AWSManagedRulesCommonRuleSet AWSManagedRulesSQLiRuleSet AWSManagedRulesUnixRuleSet AWSManagedRulesWindowsRuleSet AWSManagedRulesPHPRuleSet AWSManagedRulesWordPressRuleSet
This is given a score of Partial (instead of Minimal) because while it only protects against a subset of sub-techniques, it does provide protections for command and scripting interpreters that do not have sub-techniques (SQL, PHP, etc.). Furthermore, it blocks the malicious content in near real-time.
References
|
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1059.007 | JavaScript | 6 |
| T1059.002 | AppleScript | 2 |
| T1059.010 | AutoHotKey & AutoIT | 5 |
| T1059.009 | Cloud API | 6 |
| T1059.008 | Network Device CLI | 7 |
| T1059.001 | PowerShell | 7 |
| T1059.004 | Unix Shell | 4 |
| T1059.011 | Lua | 7 |
| T1059.013 | Container CLI/API | 1 |
| T1059.006 | Python | 7 |
| T1059.003 | Windows Command Shell | 4 |
| T1059.012 | Hypervisor CLI | 1 |
| T1059.005 | Visual Basic | 7 |