Command and Scripting Interpreter
Description
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix Shell](https://attack.mitre.org/techniques/T1059/004) while Windows installations include the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). There are also cross-platform interpreters such as [Python](https://attack.mitre.org/techniques/T1059/006), as well as those commonly associated with client applications such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) and [Visual Basic](https://attack.mitre.org/techniques/T1059/005). Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in [Initial Access](https://attack.mitre.org/tactics/TA0001) payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various [Remote Services](https://attack.mitre.org/techniques/T1021) in order to achieve remote Execution.(Citation: Powershell Remote Commands)(Citation: Cisco IOS Software Integrity Assurance - Command History)(Citation: Remote Shell Execution in Python)
Mapped SPARTA techniques
2 techniques
Mapped by SPARTA, not curated by SafeMode Space.
Mapped by SPARTA, not curated by SafeMode Space.
Cross-framework references
Relationships published by the source frameworks themselves, reproduced here with attribution. They are not SafeMode Space mappings and carry no confidence rating of ours.
Countered by 15 in MITRE D3FEND (Defensive Techniques)
- D3-CFContent Filtering
- D3-CMContent Modification
- D3-CQContent Quarantine
- D3-DADynamic Analysis
- D3-DFDecoy File
- D3-EALExecutable Allowlisting
- D3-EDLExecutable Denylisting
- D3-EFAEmulated File Analysis
- D3-FAFile Analysis
- D3-FEFile Encryption
- D3-FEVFile Eviction
- D3-FIMFile Integrity Monitoring
- D3-LFPLocal File Permissions
- D3-RFRestore File
- D3-RFAMRemote File Access Mediation
Cite as SafeMode Space, mitre-attack-enterprise T1059.