T1059 Command and Scripting Interpreter
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. MITRE ATT&CK
20 programs on CmdID 80 Sigma rules T1059 on attack.mitre.org
Its sub-techniques
T1059.001Command and Scripting Interpreter: PowerShell
T1059.002Command and Scripting Interpreter: AppleScript
T1059.003Command and Scripting Interpreter: Windows Command Shell
T1059.004Command and Scripting Interpreter: Unix Shell
T1059.005Command and Scripting Interpreter: Visual Basic
T1059.006Command and Scripting Interpreter: Python
T1059.007Command and Scripting Interpreter: JavaScript
T1059.012Command and Scripting Interpreter: Hypervisor CLI
Programs for it
awkits Sigma rulescapshits Sigma rulescmd.exeits Sigma rulesconhost.exeits Sigma rulescsc.exeits Sigma rulesdotnet.exeExecuteforfiles.exeits Sigma rulesfsi.exeAWL Bypassfsianycpu.exeAWL Bypassftp.exeits Sigma rulesopenconsole.exeits Sigma rulespcalua.exeits Sigma rulespythonits Sigma rulesrsyncits Sigma rulesrunscripthelper.exeits Sigma rulessshits Sigma rulesviits Sigma rulesvimits Sigma ruleswinget.exeits Sigma ruleswsl.exeits Sigma rulesSigma rules tagged with it
criticalHackTool - Sliver C2 Implant Activity PatternNasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) · Windows
highCapsh Shell Invocation - LinuxLi Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · Linux
highCVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux)Andreas Braathen (mnemonic.io) · Linux
highInline Python Execution - Spawn Shell Via OS System LibraryLi Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · Linux
highLinux Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali · Linux
highOutlook EnableUnsafeClientMailRules Setting EnabledMarkus Neis, Nasreddine Bencherchali (Nextron Systems) · Windows
highPotential CobaltStrike Process PatternsFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
highPotential CVE-2021-40444 Exploitation AttemptFlorian Roth (Nextron Systems), @neonprimetime · Windows
highPotential Netcat Reverse Shell Execution@d4ns4n_, Nasreddine Bencherchali (Nextron Systems) · Linux
highPotentially Suspicious Execution From Parent Process In Public FolderFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
highRenamed PingCastle Binary ExecutionNasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · Windows
highRun PowerShell Script from Redirected Input StreamMoriarty Meng (idea), Anton Kutepov (rule), oscd.community · Windows
highScript Interpreter Execution From Suspicious FolderFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
highShell Execution via Git - LinuxLi Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · Linux
highShell Execution via Rsync - LinuxLi Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth · Linux
highShell Invocation Via Ssh - LinuxLi Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · Linux
highSuspicious Greedy Compression Using Rar.EXEX__Junior (Nextron Systems), Florian Roth (Nextron Systems) · Windows
highSuspicious Invocation of Shell via AWK - LinuxLi Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · Linux
highSuspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change ScriptNasreddine Bencherchali (Nextron Systems) · Windows
highSuspicious Remote Child Process From OutlookMarkus Neis, Nasreddine Bencherchali (Nextron Systems) · Windows
highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali · Windows
mediumAdd Potential Suspicious New Download Source To WingetNasreddine Bencherchali (Nextron Systems) · Windows
mediumCVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)Andreas Braathen (mnemonic.io) · Windows
mediumElevated System Shell Spawned From Uncommon Parent Locationfrack113, Tim Shelton (update fp) · Windows
mediumForfiles Command ExecutionTim Rauch, Elastic, E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community · Windows
mediumInstall New Package Via Winget Local ManifestSreeman, Florian Roth (Nextron Systems), frack113 · Windows
mediumPotential KamiKakaBot Activity - Lure Document ExecutionNasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · Windows
mediumPotential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE@kostastsale · Windows
mediumPotential Persistence Via VMwareToolBoxCmd.EXE VM State Change ScriptNasreddine Bencherchali (Nextron Systems) · Windows
mediumUse of Pcalua For ExecutionNasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community · Windows
Command lines CmdID reads as it
Run the specified command for each file on the page for forfiles.exe
forfiles /c "command"IdentifyTo set the value TEST^1 for the environment variable named testVar, type on the page for set
set testVar=TEST^^1IdentifyAn example is here when CmdID’s reading of it names T1059: a Sigma rule it trips is tagged with it, or its abuse is documented as it.