[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1059-007":3},{"item":4,"lessons":18,"controls":44,"related":73},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1059-007","T1059.007","JavaScript",6,"MITRE","**What attackers do.** Attackers use JavaScript, or Microsoft's JScript, to run malicious code through script hosts, browsers or runtimes such as Node.js. Malicious JavaScript files are often sent as attachments or served by compromised websites. This serves the Execution tactic.\n\n**How to defend.** Change default file associations so script files open in a text editor rather than running, restrict script hosts with application control, and keep browsers and runtimes patched. Endpoint detection should watch script hosts and their child processes. Disable Windows Script Host for users who do not need it, which removes a common route for malicious script files.\n\n**Signs to look for.** Look for script hosts running files from download or email folders, scripts spawning shells or making network connections, and heavily obfuscated scripts. A common gap is that script files in archives bypass attachment filters.","Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.\n\nJScript is the Microsoft implementation of the same scripting standard. JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the Component Object Model and Internet Explorer HTML Application (HTA) pages.\n\nJavaScript for Automation (JXA) is a macOS scripting language based on JavaScript, included as part of Apple’s Open Scripting Architecture (OSA), that was introduced in OSX 10.10. Apple’s OSA provides scripting capabilities to control applications, interface with the operating system, and bridge access into the rest of Apple’s internal APIs. As of OSX 10.10, OSA only supports two languages, JXA and AppleScript. Scripts can be executed via the command line utility `osascript`, they can be compiled into applications or script files via `osacompile`, and they can be compiled and executed in memory of other programs by leveraging the OSAKit Framework.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1059\u002F007\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40],{"slug":21,"title":22,"published_at":23},"nodejs-abused-as-trojan-horse-for-malware-delivery","Node.js Abused as Trojan Horse for Malware Delivery","2026-09-03T12:21:12.111+00:00",{"slug":25,"title":26,"published_at":27},"iranian-hackers-use-fake-recruiter-personas-to-deploy-cross-platform-rats-via-trojanized-coding-test","Iranian Hackers Use Fake Recruiter Personas to Deploy Cross-Platform RATs via Trojanized Coding Tests","2026-09-01T14:21:13.071+00:00",{"slug":29,"title":30,"published_at":31},"apt-group-mirage-kitten-uses-trojanized-coding-challenges-to-deploy-novel-rats","APT Group Mirage Kitten Uses Trojanized Coding Challenges to Deploy Novel RATs","2026-09-01T08:21:27.705+00:00",{"slug":33,"title":34,"published_at":35},"trojanized-quickfox-vpn-installer-delivers-state-sponsored-backdoor","Trojanized QuickFox VPN Installer Delivers State-Sponsored Backdoor","2026-08-05T08:21:16.411+00:00",{"slug":37,"title":38,"published_at":39},"owa-xss-flaw-lets-russian-hackers-survive-credential-resets","OWA XSS Flaw Lets Russian Hackers Survive Credential Resets","2026-07-30T08:20:44.185+00:00",{"slug":41,"title":42,"published_at":43},"russian-hackers-exploit-zimbra-zero-click-xss-to-steal-email-mfa-tokens","Russian Hackers Exploit Zimbra Zero-Click XSS to Steal Email & MFA Tokens","2026-07-23T18:20:44.189+00:00",[45,50,55,60,64,68],{"slug":46,"name":47,"problem":48,"stories":49},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",5,{"slug":51,"name":52,"problem":53,"stories":54},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",4,{"slug":56,"name":57,"problem":58,"stories":59},"patch-management","Automated patch management","Known holes get closed in days, not months.",2,{"slug":61,"name":62,"problem":63,"stories":59},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":65,"name":66,"problem":67,"stories":59},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":69,"name":70,"problem":71,"stories":72},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",1,[74,79,84,89,94,98,102,106],{"family":75,"item":76,"code":77,"title":78,"together":49},"nist-800-53","si-3","SI-3","Malicious Code Protection",{"family":80,"item":81,"code":82,"title":83,"together":54},"cis","2","Control 2","Inventory and Control of Software Assets",{"family":80,"item":85,"code":86,"title":87,"together":88},"13","Control 13","Network Monitoring and Defense",3,{"family":90,"item":91,"code":92,"title":93,"together":88},"nist-sp","800-61","SP 800-61","SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management",{"family":80,"item":95,"code":96,"title":97,"together":88},"7","Control 7","Continuous Vulnerability Management",{"family":80,"item":99,"code":100,"title":101,"together":59},"12","Control 12","Network Infrastructure Management",{"family":80,"item":103,"code":104,"title":105,"together":59},"14","Control 14","Security Awareness and Skills Training",{"family":80,"item":107,"code":108,"title":109,"together":59},"10","Control 10","Malware Defenses"]