THREATNOIR
Subscribe
MITRE ATT&CK · T1059.007

JavaScript

MITRE · cited in 6 of our lessons

Explanation

What attackers do. Attackers use JavaScript, or Microsoft's JScript, to run malicious code through script hosts, browsers or runtimes such as Node.js. Malicious JavaScript files are often sent as attachments or served by compromised websites. This serves the Execution tactic.

How to defend. Change default file associations so script files open in a text editor rather than running, restrict script hosts with application control, and keep browsers and runtimes patched. Endpoint detection should watch script hosts and their child processes. Disable Windows Script Host for users who do not need it, which removes a common route for malicious script files.

Signs to look for. Look for script hosts running files from download or email folders, scripts spawning shells or making network connections, and heavily obfuscated scripts. A common gap is that script files in archives bypass attachment filters.

Open the technique on MITRE ATT&CK
The official text
Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser. JScript is the Microsoft implementation of the same scripting standard. JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the Component Object Model and Internet Explorer HTML Application (HTA) pages. JavaScript for Automation (JXA) is a macOS scripting language based on JavaScript, included as part of Apple’s Open Scripting Architecture (OSA), that was introduced in OSX 10.10. Apple’s OSA provides scripting capabilities to control applications, interface with the operating system, and bridge access into the rest of Apple’s internal APIs. As of OSX 10.10, OSA only supports two languages, JXA and AppleScript. Scripts can be executed via the command line utility `osascript`, they can be compiled into applications or script files via `osacompile`, and they can be compiled and executed in memory of other programs by leveraging the OSAKit Framework.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.