Command and Scripting Interpreter

APT19 downloaded and launched code within a SCT file.^[4]

APT32 has used COM scriptlets to download Cobalt Strike beacons.^[5]

APT37 has used Ruby scripts to execute payloads.^[6]

APT39 has utilized custom scripts to perform internal reconnaissance.^[7][8]

Bandook can support commands to execute Java-based payloads.^[9]

Bonadan can create bind and reverse shells on the infected system.^[10]

CHOPSTICK is capable of performing remote command execution.^[11][12]

During Cutting Edge, threat actors used Perl scripts to enable the deployment of the THINSPOOL shell script dropper and for enumerating host data.^[13][14]

DarkComet can execute various types of scripts on the victim’s machine.^[15]

Donut can generate shellcode outputs that execute via Ruby.^[16]

Dragonfly has used the command line for execution.^[17]

Empire uses a command-line interface to interact with systems.^[18]

FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.^[19]

FIN6 has used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.^[20][21]

FIN7 used SQL scripts to help perform tasks on the victim's machine.^[22][23][22]

FIVEHANDS can receive a command line argument to limit file encryption to specified directories.^[24][25]

Fox Kitten has used a Perl reverse shell to communicate with C2.^[26]

Get2 has the ability to run executables with command-line arguments.^[27]

gh0st RAT is able to open a remote shell to execute commands.^[28][29]

Imminent Monitor has a CommandPromptPacket and ScriptPacket module(s) for creating a remote shell and executing scripts.^[30]

Malware used by Ke3chang can run commands on the command-line interface.^[31][32]

Kessel can create a reverse shell between the infected host and a specified system.^[10]

Matryoshka is capable of providing Meterpreter shell access.^[33]

OilRig has used various types of scripting for execution.^{[34][35][36][37][38]}

For Operation Spalax, the threat actors used Nullsoft Scriptable Install System (NSIS) scripts to install malware.^[39]

P.A.S. Webshell has the ability to create reverse shells with Perl scripts.^[40]

Raspberry Robin variants can be delivered via highly obfuscated Windows Script Files (WSF) for initial execution.^[41]

Saint Bear has used the Windows Script Host (wscript) to execute intermediate files written to victim machines.^[42]

SLIGHTPULSE contains functionality to execute arbitrary commands passed to it.^[43]

SpeakUp uses Perl scripts.^[44]

Stealth Falcon malware uses WMI to script data collection and command execution on the victim.^[45]

VersaMem was delivered as a Java Archive (JAR) that runs by attaching itself to the Apache Tomcat Java servlet and web server.^[46]

Whitefly has used a simple remote shell tool that will call back to the C2 server and wait for commands.^[47]

Windigo has used a Perl script for information gathering.^[10]

WINERACK can create a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands.^[48]

Winter Vivern used XLM 4.0 macros for initial code execution for malicious document files.^[49]

ZeroCleare can receive command line arguments from an operator to corrupt the file system using the RawDisk driver.^[50]

Zeus Panda can launch remote scripts on the victim’s machine.^[51]

Anti-virus can be used to automatically quarantine suspicious files.

Inventory systems for unauthorized command and scripting interpreter installations.

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Visual Basic and JavaScript scripts from executing potentially malicious downloaded content ^[52].

Where possible, only permit execution of signed scripts.

Disable or remove any unnecessary or unused shells or interpreters.

Use application control where appropriate. For example, PowerShell Constrained Language mode can be used to restrict access to sensitive or otherwise dangerous language elements such as those used to execute arbitrary Windows APIs or files (e.g., Add-Type).^[53]

Prevent user installation of unrequired command and scripting interpreters.

When PowerShell is necessary, consider restricting PowerShell execution policy to administrators. Be aware that there are methods of bypassing the PowerShell execution policy, depending on environment configuration.^[54]

PowerShell JEA (Just Enough Administration) may also be used to sandbox administration and limit what commands admins/users can execute through remote PowerShell sessions.^[55]

Script blocking extensions can help prevent the execution of scripts and HTA files that may commonly be used during the exploitation process. For malicious code served up through ads, adblockers can help prevent that code from executing in the first place.