T1059: Command and Scripting Interpreter

ATT&CK Mapping

Field	Value
Technique ID	T1059
Name	Command and Scripting Interpreter
Tactic	Execution (execution)
Platforms	Containers, ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS, Windows
Sub-technique	No

Why it matters

In the OpenTrojan knowledge graph, Command and Scripting Interpreter (T1059) is one of the highest-connectivity ATT&CK techniques: 44 MITRE STIX relationships reference this technique; 17 threat groups observed using it; 23 software families associated; 4 campaigns associated; 9 OpenTrojan content pages reference it. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.

How attackers use it

Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1059). Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.

Detection

DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse AN1428 Detects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events. AN1429 Detects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh. AN1430 Detects launch of command-line interpreters via Terminal, Automator, or hidden osascript , especially when parent process lineage deviates from user-initiated applications. AN1431 Detects use of ‘esxcli system’ or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly. AN1432 Identifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) via enable mode or scripting-capable sessions used by uncommon accounts or from unknown IPs.

Detection strategy text is from the MITRE ATT&CK official technique page (https://attack.mitre.org/techniques/T1059).

Mitigation

Restricting web-based content involves enforcing policies and technologies that limit access to potentially malicious websites, unsafe downloads, and unauthorized browser behaviors. This can include URL filtering, download restrictions, script blocking, and extension control to protect against exploitation, phishing, and malware delivery. This mitigation can be implemented through the following measures:

Deploy Web Proxy Filtering:

• Use solutions to filter web traffic based on categories, reputation, and content types.
• Enforce policies that block unsafe websites or file types at the gateway level.

Enable DNS-Based Filtering:

• Implement tools to restrict access to domains associated with malware or phishing campaigns.
• Use public DNS filtering services to enhance protection.

Enforce Content Security Policies (CSP):

• Configure CSP headers on internal and external web applications to restrict script execution, iframe embedding, and cross-origin requests.

Control Browser Features:

• Disable unapproved browser features like automatic downloads, developer tools, or unsafe scripting.
• Enforce policies through tools like Group Policy Management to control browser settings.

Monitor and Alert on Web-Based Threats:

• Use SIEM tools to collect and analyze web proxy logs for signs of anomalous or malicious activity.
• Configure alerts for access attempts to blocked domains or repeated file download failures.

Mitigation guidance is from the MITRE ATT&CK course-of-action associated with this technique.

Related Software

• NICECURL
• Get2
• VersaMem
• Zeus Panda
• Matryoshka
• P.A.S. Webshell
• WINERACK
• Bonadan
• Raspberry Robin
• DarkComet
• MuddyViper
• Bandook

Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).

Related Threat Groups

• Dragonfly
• APT32
• FIN6
• FIN7
• Mustang Panda
• APT39
• APT37
• OilRig
• Windigo
• Ke3chang
• Saint Bear
• Winter Vivern

Group associations are from MITRE ATT&CK STIX relationships.

Related Campaigns

• Operation Spalax
• Cutting Edge
• ArcaneDoor
• FLORAHOX Activity

Campaign associations are from MITRE ATT&CK STIX relationships.

Related Content

• APT17
• APT28 (Fancy Bear)
• APT40
• Aqua Blizzard
• HAFNIUM
• MuddyWater

References

• https://attack.mitre.org/techniques/T1059
• https://www.thepythoncode.com/article/executing-bash-commands-remotely-in-python
• https://tools.cisco.com/security/center/resources/integrity_assurance.html#23
• https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/running-remote-commands?view=powershell-7.1