CmdID

CmdID / Techniques / T1059

T1059.005 Command and Scripting Interpreter: Visual Basic

Adversaries may abuse Visual Basic (VB) for execution. MITRE ATT&CK

6 programs on CmdID 18 Sigma rules T1059.005 on attack.mitre.org

Part of

MITRE ATT&CK
T1059Command and Scripting Interpreter

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
csc.exeits Sigma rulescscript.exeits Sigma ruleshh.exeits Sigma rulesmshta.exeits Sigma ruleswmic.exeits Sigma ruleswscript.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first
criticalPotential QBot ActivityFlorian Roth (Nextron Systems) · Windows
highAdwind RAT / JRATFlorian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community · Windows
highAxios NPM Compromise Indicators - WindowsSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highCsc.EXE Execution Form Potentially Suspicious ParentFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · Windows
highCscript/Wscript Uncommon Script Extension ExecutionNasreddine Bencherchali (Nextron Systems) · Windows
highHackTool - Koadic Executionwagga, Jonhnathan Ribeiro, oscd.community · Windows
highHTML Help HH.EXE Suspicious Child ProcessMaxim Pavlunin, Nasreddine Bencherchali (Nextron Systems) · Windows
highPotential APT10 Cloud Hopper ActivityFlorian Roth (Nextron Systems) · Windows
highPotential Remote SquiblyTwo Technique ExecutionMarkus Neis, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows
highSuspicious Child Process Of BgInfo.EXENasreddine Bencherchali (Nextron Systems) · Windows
highSuspicious HH.EXE ExecutionMaxim Pavlunin · Windows
highSuspicious Reconnaissance Activity Via GatherNetworkInfo.VBSNasreddine Bencherchali (Nextron Systems) · Windows
highWindows Shell/Scripting Processes Spawning Suspicious ProgramsFlorian Roth (Nextron Systems), Tim Shelton · Windows
mediumPotential Dropper Script Execution Via WScript/CScript/MSHTAMargaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems), Dave Johnson · Windows
mediumPotential Reconnaissance Activity Via GatherNetworkInfo.VBSblueteamer8699 · Windows
mediumRegistry Modification Attempt Via VBScriptSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
mediumWSF/JSE/JS/VBA/VBE File Execution Via Cscript/WscriptMichael Haag · Windows
mediumXSL Script Execution Via WMIC.EXETimur Zinniatullin, oscd.community, Swachchhanda Shrawan Poudel · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Run a script on the page for cscript.exe

cscript path\to\script.vbsIdentify

Run script in the interactive or batch mode (enable or suppress alerts, prompts, and scripting errors) on the page for cscript.exe

cscript //i path\to\script.vbsIdentify

Run a script on the page for wscript.exe

wscript path\to\script.vbsIdentify

Run script in the interactive or batch mode (enable or suppress alerts, prompts, and scripting errors) on the page for wscript.exe

wscript //i path\to\script.vbsIdentify

Install a product key (Note: It replaces the existing key) on the page for ospp.vbs

cscript ospp.vbs /inpkey:product_keyIdentify

Uninstall an installed product key with the last five digits of the product key on the page for ospp.vbs

cscript ospp.vbs /unpkey:product_key_digitsIdentify

Set a KMS host name on the page for ospp.vbs

cscript ospp.vbs /sethst:ipIdentify

Set a KMS port on the page for ospp.vbs

cscript ospp.vbs /setprt:portIdentify

Activate installed Office product keys on the page for ospp.vbs

cscript ospp.vbs /actIdentify

Display license information for installed product keys on the page for ospp.vbs

cscript ospp.vbs /dstatusIdentify

display the current Windows license information on the page for slmgr.vbs

cscript slmgr.vbs /dliIdentify

display the installation iD for the current device. Useful for offline license activation on the page for slmgr.vbs

cscript slmgr.vbs /dtiIdentify

And 6 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1059.005: a Sigma rule it trips is tagged with it, or its abuse is documented as it.