ATT&CK Reference
Portfolio

TA0002 · EXECUTION

Command and Scripting Interpreter

T1059IaaS · Identity Provider · Linux · Network Devices · Office Suite · Windows · macOS · ESXiattack.mitre.org

PowerShell, cmd, bash, Python, JavaScript, and Visual Basic used to run adversary commands.

Detect it with

Encoded PowerShell (-enc, -w hidden), Office applications spawning interpreters, script block logging (Event ID 4104).

Why it matters on shift

Command and Scripting Interpreter is one of the concrete ways adversaries achieve execution. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.

What to look for next

After execution, the next tactic is usually Persistence. Search your telemetry for the transition before closing the ticket.

12 sub-techniques

How it shows up in practice

  1. T1059.001

    PowerShell

    Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.

  2. T1059.002

    AppleScript

    Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

  3. T1059.003

    Windows Command Shell

    Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems.

  4. T1059.004

    Unix Shell

    Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g.

  5. T1059.005

    Visual Basic

    Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as Component Object Model and the Native API through the Windows API.

  6. T1059.006

    Python

    Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions.

  7. T1059.007

    JavaScript

    Adversaries may abuse various implementations of JavaScript for execution.

  8. T1059.008

    Network Device CLI

    Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.

  9. T1059.009

    Cloud API

    Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant.

  10. T1059.010

    AutoHotKey & AutoIT

    Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages that enable users to automate Windows tasks.

  11. T1059.011

    Lua

    Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications.

  12. T1059.012

    Hypervisor CLI

    Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands. Hypervisor CLIs typically enable a wide variety of functionality for managing both the hypervisor itself and the guest virtual machines it hosts.

Kill-chain context

← beforeInitial AccessExecutionafter →Persistence