Command and Scripting Interpreter

Description

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic.

Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.

ATLAS ID: AML.T0050
Maturity: RealizedUsed by real adversaries against AI systems in the wild.
Platforms: Enterprise

Mitigations

AML.M0011Restrict Library Loading
Restrict library loading so command and script interpreters cannot load untrusted libraries as an execution mechanism.

Case studies that use it

Related ATT&CK technique

ATLAS adapts this technique from MITRE ATT&CK Enterprise.

T1059Command and Scripting Interpreter

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

3 more in the full list

Detect with CAR

MITRE CAR analytics that cover the same ATT&CK techniques.

Execution AML.T0050