[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1059":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1059","T1059","Command and Scripting Interpreter",65,"MITRE","**What attackers do.** Attackers use built-in command shells and scripting languages such as PowerShell, Windows Command Shell, Unix shells, Python or JavaScript to run their commands and tools. Because these interpreters are present and trusted on most systems, this is central to the Execution tactic.\n\n**How to defend.** Restrict who can run interpreters and where, using application control, constrained language modes and removal of interpreters that are not needed. Enable detailed logging such as PowerShell script block logging, command line capture in process creation events and shell history collection. Endpoint detection rules should focus on suspicious parent and child relationships rather than the interpreter itself.\n\n**Signs to look for.** Look for encoded or heavily obfuscated command lines, scripts launched by Office applications, browsers or web servers, and interpreters downloading content from the internet. A common gap is missing command line arguments in process logs, which hides what was actually run.","Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.\n\nThere are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic.\n\nAdversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals\u002Fshells, as well as utilize various Remote Services in order to achieve remote Execution.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1059\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"romulus-malware-platform-exploits-human-deception-via-clickfix-lures","ROMULUS Malware Platform Exploits Human Deception via ClickFix Lures","2026-10-16T15:20:34.428+00:00",{"slug":25,"title":26,"published_at":27},"silent-lynx-exploits-unpatched-winrar-flaw-to-backdoor-cis-governments","Silent Lynx Exploits Unpatched WinRAR Flaw to Backdoor CIS Governments","2026-10-15T18:20:53.262+00:00",{"slug":29,"title":30,"published_at":31},"record-1411-vulnerabilities-patched-including-3-zero-days-in-microsoft-october-2026-patch-tuesday","Record 1,411 Vulnerabilities Patched Including 3 Zero-Days in Microsoft October 2026 Patch Tuesday","2026-10-13T20:20:18.566+00:00",{"slug":33,"title":34,"published_at":35},"unpatched-ahsaycbs-backup-flaws-actively-exploited-for-remote-code-execution","Unpatched AhsayCBS Backup Flaws Actively Exploited for Remote Code Execution","2026-10-09T12:22:15.804+00:00",{"slug":37,"title":38,"published_at":39},"poellm-botnet-hides-c2-infrastructure-in-github-poem-to-evade-detection","PoeLLM Botnet Hides C2 Infrastructure in GitHub Poem to Evade Detection","2026-10-07T16:20:39.103+00:00",{"slug":41,"title":42,"published_at":43},"malicious-spreadsheets-exploit-libreoffice-openoffice-to-run-code-silently","Malicious Spreadsheets Exploit LibreOffice & OpenOffice to Run Code Silently","2026-10-06T12:20:27.3+00:00",{"slug":45,"title":46,"published_at":47},"chatgpt-macos-app-flaw-exposed-chat-logs-and-browser-sessions","ChatGPT macOS App Flaw Exposed Chat Logs and Browser Sessions","2026-10-02T10:20:19.849+00:00",{"slug":49,"title":50,"published_at":51},"malicious-custom-gpts-used-to-deliver-remote-access-trojans","Malicious Custom GPTs Used to Deliver Remote Access Trojans","2026-09-30T22:20:24.817+00:00",{"slug":53,"title":54,"published_at":55},"ai-driven-zero-day-exploit-chain-breaches-divd-via-zammad-ticketing-system","AI-Driven Zero-Day Exploit Chain Breaches DIVD via Zammad Ticketing System","2026-09-30T20:20:27.712+00:00",{"slug":57,"title":58,"published_at":59},"star-blizzard-evolves-phishing-tactics-with-redflick-campaign","Star Blizzard Evolves Phishing Tactics with RedFlick Campaign","2026-09-30T16:22:02.201+00:00",{"slug":61,"title":62,"published_at":63},"fake-chatgpt-ads-use-clickfix-to-deploy-remote-access-trojans","Fake ChatGPT Ads Use ClickFix to Deploy Remote Access Trojans","2026-09-29T22:21:13.221+00:00",{"slug":65,"title":66,"published_at":67},"star-blizzards-redflick-phishing-technique-targets-ukraine-supporters","Star Blizzard's RedFlick Phishing Technique Targets Ukraine Supporters","2026-09-29T16:21:38.067+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",52,{"slug":75,"name":76,"problem":77,"stories":78},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",25,{"slug":80,"name":81,"problem":82,"stories":83},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",17,{"slug":85,"name":86,"problem":87,"stories":88},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",14,{"slug":90,"name":91,"problem":92,"stories":93},"patch-management","Automated patch management","Known holes get closed in days, not months.",12,{"slug":95,"name":96,"problem":97,"stories":93},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[99,105,111,116,122,127,131,136],{"family":100,"item":101,"code":102,"title":103,"together":104},"nist-800-53","si-3","SI-3","Malicious Code Protection",38,{"family":106,"item":107,"code":108,"title":109,"together":110},"cis","13","Control 13","Network Monitoring and Defense",35,{"family":106,"item":112,"code":113,"title":114,"together":115},"2","Control 2","Inventory and Control of Software Assets",29,{"family":117,"item":118,"code":119,"title":120,"together":121},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",24,{"family":106,"item":123,"code":124,"title":125,"together":126},"7","Control 7","Continuous Vulnerability Management",23,{"family":100,"item":128,"code":129,"title":130,"together":126},"sc-7","SC-7","Boundary Protection",{"family":106,"item":132,"code":133,"title":134,"together":135},"14","Control 14","Security Awareness and Skills Training",21,{"family":137,"item":138,"code":139,"title":140,"together":135},"gdpr","32","Article 32","Security of processing"]