THREATNOIR
Subscribe
MITRE ATT&CK · T1059

Command and Scripting Interpreter

MITRE · cited in 65 of our lessons

Explanation

What attackers do. Attackers use built-in command shells and scripting languages such as PowerShell, Windows Command Shell, Unix shells, Python or JavaScript to run their commands and tools. Because these interpreters are present and trusted on most systems, this is central to the Execution tactic.

How to defend. Restrict who can run interpreters and where, using application control, constrained language modes and removal of interpreters that are not needed. Enable detailed logging such as PowerShell script block logging, command line capture in process creation events and shell history collection. Endpoint detection rules should focus on suspicious parent and child relationships rather than the interpreter itself.

Signs to look for. Look for encoded or heavily obfuscated command lines, scripts launched by Office applications, browsers or web servers, and interpreters downloading content from the internet. A common gap is missing command line arguments in process logs, which hides what was actually run.

Open the technique on MITRE ATT&CK
The official text
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 65.