CmdID

CmdID / Techniques / T1059

T1059.007 Command and Scripting Interpreter: JavaScript

Adversaries may abuse various implementations of JavaScript for execution. MITRE ATT&CK

6 programs on CmdID 21 Sigma rules T1059.007 on attack.mitre.org

Part of

MITRE ATT&CK
T1059Command and Scripting Interpreter

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
csc.exeits Sigma rulescscript.exeits Sigma ruleshh.exeits Sigma rulesmshta.exeits Sigma ruleswmic.exeits Sigma ruleswscript.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first
highAdwind RAT / JRATFlorian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community · Windows
highCsc.EXE Execution Form Potentially Suspicious ParentFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · Windows
highCscript/Wscript Uncommon Script Extension ExecutionNasreddine Bencherchali (Nextron Systems) · Windows
highHackTool - Koadic Executionwagga, Jonhnathan Ribeiro, oscd.community · Windows
highHTML Help HH.EXE Suspicious Child ProcessMaxim Pavlunin, Nasreddine Bencherchali (Nextron Systems) · Windows
highJXA In-memory Execution Via OSAScriptSohan G (D4rkCiph3r) · macOS
highMSHTA Execution with Suspicious File ExtensionsDiego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems) · Windows
highPotential Remote SquiblyTwo Technique ExecutionMarkus Neis, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows
highScript Interpreter Spawning Credential Scanner - WindowsSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highSuspicious HH.EXE ExecutionMaxim Pavlunin · Windows
highTanStack Supply-Chain Attack Execution Indicators - LinuxLeonardo Gasparini · Linux
highTanStack Supply-Chain Attack Execution Indicators - WindowsLeonardo Gasparini · Windows
mediumNew Agent Skills Installation Attempt Via Node.EXEMarco Pedrinazzi (@pedrinazziM) (InTheCyber) · Windows
mediumNode Process ExecutionsMax Altgelt (Nextron Systems) · Windows
mediumPotential Dropper Script Execution Via WScript/CScript/MSHTAMargaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems), Dave Johnson · Windows
mediumPotential In-Memory Download And Compile Of PayloadsSohan G (D4rkCiph3r), Red Canary (idea) · macOS
mediumPotentially Suspicious Inline JavaScript Execution via NodeJS BinaryMicrosoft (idea), Swachchhanda Shrawan Poudel (Nextron Systems) · Windows
mediumSuspicious Installer Package Child ProcessSohan G (D4rkCiph3r) · macOS
mediumWSF/JSE/JS/VBA/VBE File Execution Via Cscript/WscriptMichael Haag · Windows
mediumXSL Script Execution Via WMIC.EXETimur Zinniatullin, oscd.community, Swachchhanda Shrawan Poudel · Windows
lowNodeJS Execution of JavaScript FileSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Run a script on the page for cscript.exe

cscript path\to\script.vbsIdentify

Run script in the interactive or batch mode (enable or suppress alerts, prompts, and scripting errors) on the page for cscript.exe

cscript //i path\to\script.vbsIdentify

Run a script on the page for wscript.exe

wscript path\to\script.vbsIdentify

Run script in the interactive or batch mode (enable or suppress alerts, prompts, and scripting errors) on the page for wscript.exe

wscript //i path\to\script.vbsIdentify

Install a product key (Note: It replaces the existing key) on the page for ospp.vbs

cscript ospp.vbs /inpkey:product_keyIdentify

Uninstall an installed product key with the last five digits of the product key on the page for ospp.vbs

cscript ospp.vbs /unpkey:product_key_digitsIdentify

Set a KMS host name on the page for ospp.vbs

cscript ospp.vbs /sethst:ipIdentify

Set a KMS port on the page for ospp.vbs

cscript ospp.vbs /setprt:portIdentify

Activate installed Office product keys on the page for ospp.vbs

cscript ospp.vbs /actIdentify

Display license information for installed product keys on the page for ospp.vbs

cscript ospp.vbs /dstatusIdentify

display the current Windows license information on the page for slmgr.vbs

cscript slmgr.vbs /dliIdentify

display the installation iD for the current device. Useful for offline license activation on the page for slmgr.vbs

cscript slmgr.vbs /dtiIdentify

And 6 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1059.007: a Sigma rule it trips is tagged with it, or its abuse is documented as it.