t1059-command-and-scripting-interpreter

name	T1059_command-and-scripting-interpreter
description	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
category	input-validation
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1059","execution","esxi","iaas","identity-provider","linux","macos","network-devices","office-suite","windows"]
technique_id	T1059
tactic	execution
all_tactics	["execution"]
platforms	["ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1059
tech_stack	["esxi","cloud","identity","linux","macos","network devices","office","windows"]
cwe_ids	["CWE-94"]
chains_with	["T1059.001","T1059.002","T1059.003","T1059.004","T1059.005","T1059.006","T1059.007","T1059.008","T1059.009","T1059.010","T1059.011","T1059.012","T1059.013"]
prerequisites	[]
severity_boost	{"T1059.001":"Chain with T1059.001 for deeper attack path","T1059.002":"Chain with T1059.002 for deeper attack path","T1059.003":"Chain with T1059.003 for deeper attack path"}

T1059 Command and Scripting Interpreter

High-Level Description

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic.

Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.

Kill Chain Phase

• Execution (TA0002)

Platforms: ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, Windows

What to Check

• Identify if Command and Scripting Interpreter technique is applicable to target environment
• Check ESXi systems for indicators of Command and Scripting Interpreter
• Check IaaS systems for indicators of Command and Scripting Interpreter
• Check Identity Provider systems for indicators of Command and Scripting Interpreter
• Verify mitigations are bypassed or absent (9 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: AutoIt Script Execution

An adversary may attempt to execute suspicious or malicious script using AutoIt software instead of regular terminal like powershell or cmd. Calculator will popup when the script is executed successfully.

Supported Platforms: windows

Start-Process -FilePath "#{autoit_path}" -ArgumentList "#{script_path}"